> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WAFv2

> WAFv2 APIs with Cloud Adapter.

This page describes how WAFv2 maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* OCI

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of WAFv2 with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | WAFv2 | Azure | OCI |
| - | - | - | - |
| IP allow / block | Yes | Yes - RemoteAddr IPMatch custom rule; the ip-set CIDRs inline | Partial - a network address list plus a best-effort access-control condition |
| Rate-based rules | Yes | Partial - RateLimitRule; a one- or five-minute window, so other windows round | Yes - request\_rate\_limiting; the AWS window is kept unrounded |
| Byte / geo match | Yes | Partial - match\_condition with typed match variables and operators | Partial - access-control rules with a best-effort JMESPATH condition |
| Managed rule groups · catalog fidelity | AWS managed rule groups (Common / Bot / SQLi / …) | OWASP Core Rule Set, a different catalog over the same posture | OWASP protection capabilities, a different catalog over the same posture |
| Deny-by-default allowlist | Yes | Partial - no whole-policy default deny; add a lowest-priority block rule | Yes - the access-control module's default action preserves it |
| API coverage | full | partial | partial |

## On Azure

### Azure WAF Policy

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Default action (deny-by-default) | Default action | Partial | Most usage | a default of allow maps exactly; a deny-by-default allowlist has no whole-policy analog, so add an explicit lowest-priority block rule to restore it |
| IP-set allow / block | IP sets | Supported | Common | ip\_set\_reference → a RemoteAddr IPMatch custom rule; the ip-set CIDRs inline into match\_values |
| Logging configuration | Logging | Partial | Full surface | WAF request logging is a diagnostic setting on the Application Gateway rather than a per-web-ACL logging configuration; enable it on the gateway |
| AWS managed rule groups | Managed rules | Partial | Most usage | managed\_rule\_group → the OWASP Core Rule Set managed set; the catalogs differ, so a specific AWS-managed rule id does not port 1:1, and an OWASP baseline is added when the web ACL declared none |
| Byte-match / geo-match | Match conditions | Partial | Most usage | → a match\_condition; the field\_to\_match component and positional constraint re-author to Azure match variables (RequestUri / QueryString / RequestHeaders) and operators, and geo uses two-letter country codes |
| Regex / SQLi / XSS / size / label / composite statements | Match conditions | Out of scope | Full surface | not translated to custom rules; re-express injection and cross-site checks through the OWASP managed set and a regex check as a native Azure Regex custom rule, which the policy supports |
| Rate-based rules | Rate limiting | Partial | Common | → a RateLimitRule keyed on the client address; the policy accepts a one- or five-minute window, so a window that is not 60 or 300 seconds rounds |
| Rule groups | Rule groups | Partial | Most usage | a reusable rule-group's inlined statements translate with their parent web ACL; a standalone rule-group resource is not emitted on its own |
| Web ACL rule tree | Web ACL | Supported | Common | the aws\_wafv2\_web\_acl rule tree is emitted as an azurerm\_web\_application\_firewall\_policy in priority order, evaluated by the Application Gateway WAF engine |

#### How it works

On AWS, an `aws_wafv2_web_acl` holds rules that AWS WAF evaluates in front of an ALB or a CloudFront distribution: IP-set allow and block lists, rate-based rules, byte-match and geo-match conditions, and AWS managed rule groups. On Azure, the equivalent is the Application Gateway WAF, whose rules live in an `azurerm_web_application_firewall_policy`.

When the stack is built, the web ACL becomes one Azure WAF policy. IP-set, rate-based, byte-match and geo-match statements become custom rules, and AWS managed rule groups map to the OWASP Core Rule Set. You attach the policy to your Application Gateway, and Azure's WAF evaluates every request; Tensor9 is not in the request path. Statements with no Azure equivalent are not translated, and the build names each one in a warning.

![On AWS, AWS WAF enforces the aws\_wafv2\_web\_acl rules at an ALB or CloudFront. On Azure, the build turns the same rules into an azurerm\_web\_application\_firewall\_policy that the Application Gateway WAF evaluates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgyIiB2aWV3Qm94PSIwIDAgODM2IDE4MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFXUyBXQUYgZW5mb3JjZXMgdGhlIGF3c193YWZ2Ml93ZWJfYWNsIHJ1bGVzIGF0IGFuIEFMQiBvciBDbG91ZEZyb250LiBPbiBBenVyZSwgdGhlIGJ1aWxkIHR1cm5zIHRoZSBzYW1lIHJ1bGVzIGludG8gYW4gYXp1cmVybV93ZWJfYXBwbGljYXRpb25fZmlyZXdhbGxfcG9saWN5IHRoYXQgdGhlIEFwcGxpY2F0aW9uIEdhdGV3YXkgV0FGIGV2YWx1YXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2ExIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0NCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMjIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjEwNSIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5hd3Nfd2FmdjJfd2ViX2FjbDwvdGV4dD4KPHRleHQgeD0iMTA1IiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5JUC1zZXQgwrcgcmF0ZSDCtyBtYW5hZ2VkPC90ZXh0Pgo8bGluZSB4MT0iMTgwIiB5MT0iMTE0IiB4Mj0iMjI4IiB5Mj0iMTE0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd2ExKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjIwNCIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5lbmZvcmNlZDwvdGV4dD4KPHJlY3QgeD0iMjMyIiB5PSI3OCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyOTgiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgV0FGPC90ZXh0Pgo8dGV4dCB4PSIyOTgiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFMQiAvIENsb3VkRnJvbnQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSIzOCIgeDI9IjQxOCIgeTI9IjE2MiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0NjAiIHk9IjQ0IiB3aWR0aD0iMzY0IiBoZWlnaHQ9IjEyMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ3NCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9Ijc4IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjUzOCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+c2FtZSBydWxlIHRyZWU8L3RleHQ+Cjx0ZXh0IHg9IjUzOCIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij50cmFuc2xhdGVkIGJ5IHRoZSBidWlsZDwvdGV4dD4KPGxpbmUgeDE9IjYwMiIgeTE9IjExNCIgeDI9IjY1MCIgeTI9IjExNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2NTQiIHk9Ijc0IiB3aWR0aD0iMTU2IiBoZWlnaHQ9IjgwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjczMiIgeT0iMTAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPldBRiBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjczMiIgeT0iMTE4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YXp1cmVybV93ZWJfYXBwbGljYXRpb248L3RleHQ+Cjx0ZXh0IHg9IjczMiIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+X2ZpcmV3YWxsX3BvbGljeTwvdGV4dD4KPC9zdmc+)

![On AWS, AWS WAF enforces the aws\_wafv2\_web\_acl rules at an ALB or CloudFront. On Azure, the build turns the same rules into an azurerm\_web\_application\_firewall\_policy that the Application Gateway WAF evaluates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgyIiB2aWV3Qm94PSIwIDAgODM2IDE4MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFXUyBXQUYgZW5mb3JjZXMgdGhlIGF3c193YWZ2Ml93ZWJfYWNsIHJ1bGVzIGF0IGFuIEFMQiBvciBDbG91ZEZyb250LiBPbiBBenVyZSwgdGhlIGJ1aWxkIHR1cm5zIHRoZSBzYW1lIHJ1bGVzIGludG8gYW4gYXp1cmVybV93ZWJfYXBwbGljYXRpb25fZmlyZXdhbGxfcG9saWN5IHRoYXQgdGhlIEFwcGxpY2F0aW9uIEdhdGV3YXkgV0FGIGV2YWx1YXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2ExIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0NCIgd2lkdGg9IjM2MCIgaGVpZ2h0PSIxMjIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMzAiIHk9Ijc4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjEwNSIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5hd3Nfd2FmdjJfd2ViX2FjbDwvdGV4dD4KPHRleHQgeD0iMTA1IiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5JUC1zZXQgwrcgcmF0ZSDCtyBtYW5hZ2VkPC90ZXh0Pgo8bGluZSB4MT0iMTgwIiB5MT0iMTE0IiB4Mj0iMjI4IiB5Mj0iMTE0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd2ExKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjIwNCIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5lbmZvcmNlZDwvdGV4dD4KPHJlY3QgeD0iMjMyIiB5PSI3OCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyOTgiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgV0FGPC90ZXh0Pgo8dGV4dCB4PSIyOTgiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFMQiAvIENsb3VkRnJvbnQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSIzOCIgeDI9IjQxOCIgeTI9IjE2MiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0NjAiIHk9IjQ0IiB3aWR0aD0iMzY0IiBoZWlnaHQ9IjEyMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ3NCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NzQiIHk9Ijc4IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjUzOCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+c2FtZSBydWxlIHRyZWU8L3RleHQ+Cjx0ZXh0IHg9IjUzOCIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij50cmFuc2xhdGVkIGJ5IHRoZSBidWlsZDwvdGV4dD4KPGxpbmUgeDE9IjYwMiIgeTE9IjExNCIgeDI9IjY1MCIgeTI9IjExNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2NTQiIHk9Ijc0IiB3aWR0aD0iMTU2IiBoZWlnaHQ9IjgwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjczMiIgeT0iMTAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPldBRiBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjczMiIgeT0iMTE4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YXp1cmVybV93ZWJfYXBwbGljYXRpb248L3RleHQ+Cjx0ZXh0IHg9IjczMiIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+X2ZpcmV3YWxsX3BvbGljeTwvdGV4dD4KPC9zdmc+)

The build turns your web ACL into an Azure WAF policy that the Application Gateway WAF evaluates.

#### What the build creates

Each web ACL becomes one WAF policy in the same resource group and region as the rest of the stack. The rules keep their AWS priorities. Each translated statement becomes one entry in `custom_rules`, and the policy's `managed_rules` block always includes OWASP Core Rule Set 3.2, because Azure requires a managed rule set. Policy and rule names keep only their letters and digits.

The policy runs in Prevention mode, so a matching block rule stops the request rather than only logging it. AWS allow and block actions stay allow and block; a count action becomes `Log`. The build does not attach the policy to a gateway, even if the stack had an `aws_wafv2_web_acl_association`; you attach it, as you attached the web ACL on AWS.

![The web ACL's rules become two parts of one WAF policy: custom\_rules, with one entry per translated statement, and managed\_rules, holding the OWASP Core Rule Set. The policy is created in the stack's resource group, and you attach it to the Application Gateway.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgd2ViIEFDTCdzIHJ1bGVzIGJlY29tZSB0d28gcGFydHMgb2Ygb25lIFdBRiBwb2xpY3k6IGN1c3RvbV9ydWxlcywgd2l0aCBvbmUgZW50cnkgcGVyIHRyYW5zbGF0ZWQgc3RhdGVtZW50LCBhbmQgbWFuYWdlZF9ydWxlcywgaG9sZGluZyB0aGUgT1dBU1AgQ29yZSBSdWxlIFNldC4gVGhlIHBvbGljeSBpcyBjcmVhdGVkIGluIHRoZSBzdGFjaydzIHJlc291cmNlIGdyb3VwLCBhbmQgeW91IGF0dGFjaCBpdCB0byB0aGUgQXBwbGljYXRpb24gR2F0ZXdheS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2EyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIzMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+VEhFIFNUQUNLJ1MgQVpVUkUgV0FGIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI5NSIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPndlYiBBQ0w8L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSI5NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnJ1bGUgdHJlZSwgYnkgcHJpb3JpdHk8L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSIxMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5pcC1zZXQgwrcgcmF0ZTwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPmJ5dGUgwrcgZ2VvPC90ZXh0Pgo8dGV4dCB4PSI5NSIgeT0iMTYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+bWFuYWdlZCBncm91cDwvdGV4dD4KPGxpbmUgeDE9IjE3MCIgeTE9Ijk0IiB4Mj0iMjE0IiB5Mj0iNzgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YTIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPGxpbmUgeDE9IjE3MCIgeTE9IjE0MCIgeDI9IjIxNCIgeTI9IjE1OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMTgiIHk9IjUyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjMzNyIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij5jdXN0b21fcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjMzNyIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPm9uZSBlbnRyeSBwZXIgdHJhbnNsYXRlZCBzdGF0ZW1lbnQ8L3RleHQ+CjxyZWN0IHg9IjIxOCIgeT0iMTMyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMzNyIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+bWFuYWdlZF9ydWxlczwvdGV4dD4KPHRleHQgeD0iMzM3IiB5PSIxNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5PV0FTUCBDb3JlIFJ1bGUgU2V0IDMuMjwvdGV4dD4KPGxpbmUgeDE9IjQ1NiIgeTE9IjEyNSIgeDI9IjUwNCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1MDgiIHk9Ijc2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjEwMCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1ODMiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij5XQUYgcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI1ODMiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPm1vZGUgPSBQcmV2ZW50aW9uPC90ZXh0Pgo8dGV4dCB4PSI1ODMiIHk9IjE1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPnNhbWUgcmVzb3VyY2UgZ3JvdXA8L3RleHQ+CjxsaW5lIHgxPSI2NTgiIHkxPSIxMjUiIHgyPSI3MDIiIHkyPSIxMjUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YTIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNzA2IiB5PSI4NiIgd2lkdGg9IjExMCIgaGVpZ2h0PSI4MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3NjEiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij5BcHBsaWNhdGlvbjwvdGV4dD4KPHRleHQgeD0iNzYxIiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+R2F0ZXdheTwvdGV4dD4KPC9zdmc+)

![The web ACL's rules become two parts of one WAF policy: custom\_rules, with one entry per translated statement, and managed\_rules, holding the OWASP Core Rule Set. The policy is created in the stack's resource group, and you attach it to the Application Gateway.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgd2ViIEFDTCdzIHJ1bGVzIGJlY29tZSB0d28gcGFydHMgb2Ygb25lIFdBRiBwb2xpY3k6IGN1c3RvbV9ydWxlcywgd2l0aCBvbmUgZW50cnkgcGVyIHRyYW5zbGF0ZWQgc3RhdGVtZW50LCBhbmQgbWFuYWdlZF9ydWxlcywgaG9sZGluZyB0aGUgT1dBU1AgQ29yZSBSdWxlIFNldC4gVGhlIHBvbGljeSBpcyBjcmVhdGVkIGluIHRoZSBzdGFjaydzIHJlc291cmNlIGdyb3VwLCBhbmQgeW91IGF0dGFjaCBpdCB0byB0aGUgQXBwbGljYXRpb24gR2F0ZXdheS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2EyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIzMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+VEhFIFNUQUNLJ1MgQVpVUkUgV0FGIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQ0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI5NSIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPndlYiBBQ0w8L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSI5NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnJ1bGUgdHJlZSwgYnkgcHJpb3JpdHk8L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSIxMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5pcC1zZXQgwrcgcmF0ZTwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPmJ5dGUgwrcgZ2VvPC90ZXh0Pgo8dGV4dCB4PSI5NSIgeT0iMTYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+bWFuYWdlZCBncm91cDwvdGV4dD4KPGxpbmUgeDE9IjE3MCIgeTE9Ijk0IiB4Mj0iMjE0IiB5Mj0iNzgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YTIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPGxpbmUgeDE9IjE3MCIgeTE9IjE0MCIgeDI9IjIxNCIgeTI9IjE1OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMTgiIHk9IjUyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjMzNyIgeT0iNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij5jdXN0b21fcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjMzNyIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPm9uZSBlbnRyeSBwZXIgdHJhbnNsYXRlZCBzdGF0ZW1lbnQ8L3RleHQ+CjxyZWN0IHg9IjIxOCIgeT0iMTMyIiB3aWR0aD0iMjM4IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMzNyIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+bWFuYWdlZF9ydWxlczwvdGV4dD4KPHRleHQgeD0iMzM3IiB5PSIxNzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5PV0FTUCBDb3JlIFJ1bGUgU2V0IDMuMjwvdGV4dD4KPGxpbmUgeDE9IjQ1NiIgeTE9IjEyNSIgeDI9IjUwNCIgeTI9IjEyNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dhMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1MDgiIHk9Ijc2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjEwMCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1ODMiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij5XQUYgcG9saWN5PC90ZXh0Pgo8dGV4dCB4PSI1ODMiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPm1vZGUgPSBQcmV2ZW50aW9uPC90ZXh0Pgo8dGV4dCB4PSI1ODMiIHk9IjE1MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPnNhbWUgcmVzb3VyY2UgZ3JvdXA8L3RleHQ+CjxsaW5lIHgxPSI2NTgiIHkxPSIxMjUiIHgyPSI3MDIiIHkyPSIxMjUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YTIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNzA2IiB5PSI4NiIgd2lkdGg9IjExMCIgaGVpZ2h0PSI4MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3NjEiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij5BcHBsaWNhdGlvbjwvdGV4dD4KPHRleHQgeD0iNzYxIiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+R2F0ZXdheTwvdGV4dD4KPC9zdmc+)

One web ACL becomes one WAF policy: custom rules plus the OWASP managed rule set.

#### How the rule statements translate

A `byte_match_statement` becomes a match condition. The AWS field becomes the match variable: URI path becomes `RequestUri`, query string becomes `QueryString`, method becomes `RequestMethod`, body becomes `RequestBody`, and a single header becomes `RequestHeaders`. The positional constraint becomes the operator: exactly becomes `Equal`, starts with becomes `BeginsWith`, ends with becomes `EndsWith`, and contains or contains word becomes `Contains`. The lowercase, URL-decode and HTML-entity-decode text transformations are kept.

A `geo_match_statement` becomes a `GeoMatch` rule on the client address with the same two-letter country codes. IP sets and rate-based rules are covered in the next section.

![Each AWS WAFv2 statement type maps to an Azure construct: ip\_set\_reference to a RemoteAddr IPMatch custom rule with the CIDRs inline; rate\_based to a RateLimitRule; byte\_match to a match\_condition with a typed variable; geo\_match to a GeoMatch rule; managed\_rule\_group to the OWASP managed rule set.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFXUyBXQUZ2MiBzdGF0ZW1lbnQgdHlwZSBtYXBzIHRvIGFuIEF6dXJlIGNvbnN0cnVjdDogaXBfc2V0X3JlZmVyZW5jZSB0byBhIFJlbW90ZUFkZHIgSVBNYXRjaCBjdXN0b20gcnVsZSB3aXRoIHRoZSBDSURScyBpbmxpbmU7IHJhdGVfYmFzZWQgdG8gYSBSYXRlTGltaXRSdWxlOyBieXRlX21hdGNoIHRvIGEgbWF0Y2hfY29uZGl0aW9uIHdpdGggYSB0eXBlZCB2YXJpYWJsZTsgZ2VvX21hdGNoIHRvIGEgR2VvTWF0Y2ggcnVsZTsgbWFuYWdlZF9ydWxlX2dyb3VwIHRvIHRoZSBPV0FTUCBtYW5hZ2VkIHJ1bGUgc2V0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3YTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5BV1MgV0FGdjIgU1RBVEVNRU5UPC90ZXh0Pgo8dGV4dCB4PSI1MTYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5BWlVSRSBXQUYgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMzgiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmlwX3NldF9yZWZlcmVuY2Vfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iNTUiIHgyPSI1MDYiIHkyPSI1NSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd2EzKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjUxMCIgeT0iMzgiIHdpZHRoPSIzMDYiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSI1MjQiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5SZW1vdGVBZGRyIElQTWF0Y2ggwrcgQ0lEUnMgaW5saW5lPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iODAiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iMTAyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5yYXRlX2Jhc2VkX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9Ijk3IiB4Mj0iNTA2IiB5Mj0iOTciIHN0cm9rZS13aWR0aD0iMS43IiBtYXJrZXItZW5kPSJ1cmwoI3dhMykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1MTAiIHk9IjgwIiB3aWR0aD0iMzA2IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNTI0IiB5PSIxMDIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPlJhdGVMaW1pdFJ1bGUgwrcgT25lTWluIC8gRml2ZU1pbnM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxMjIiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5ieXRlX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjEzOSIgeDI9IjUwNiIgeTI9IjEzOSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd2EzKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjUxMCIgeT0iMTIyIiB3aWR0aD0iMzA2IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNTI0IiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPm1hdGNoX2NvbmRpdGlvbiDCtyBSZXF1ZXN0VXJpLCDigKY8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxNjQiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iMTg2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5nZW9fbWF0Y2hfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iMTgxIiB4Mj0iNTA2IiB5Mj0iMTgxIiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3YTMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTEwIiB5PSIxNjQiIHdpZHRoPSIzMDYiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSI1MjQiIHk9IjE4NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1NyI+R2VvTWF0Y2ggwrcgY291bnRyeSBjb2RlczwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjIwNiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM0IiB5PSIyMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPm1hbmFnZWRfcnVsZV9ncm91cF9zdGF0ZW1lbnQ8L3RleHQ+CjxsaW5lIHgxPSIzMjYiIHkxPSIyMjMiIHgyPSI1MDYiIHkyPSIyMjMiIHN0cm9rZS13aWR0aD0iMS43IiBtYXJrZXItZW5kPSJ1cmwoI3dhMykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1MTAiIHk9IjIwNiIgd2lkdGg9IjMwNiIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojYzdkMmZlIi8+Cjx0ZXh0IHg9IjUyNCIgeT0iMjI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojNGY0NmU1Ij5tYW5hZ2VkX3J1bGVfc2V0IMK3IE9XQVNQIENSUzwvdGV4dD4KPC9zdmc+)

![Each AWS WAFv2 statement type maps to an Azure construct: ip\_set\_reference to a RemoteAddr IPMatch custom rule with the CIDRs inline; rate\_based to a RateLimitRule; byte\_match to a match\_condition with a typed variable; geo\_match to a GeoMatch rule; managed\_rule\_group to the OWASP managed rule set.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFXUyBXQUZ2MiBzdGF0ZW1lbnQgdHlwZSBtYXBzIHRvIGFuIEF6dXJlIGNvbnN0cnVjdDogaXBfc2V0X3JlZmVyZW5jZSB0byBhIFJlbW90ZUFkZHIgSVBNYXRjaCBjdXN0b20gcnVsZSB3aXRoIHRoZSBDSURScyBpbmxpbmU7IHJhdGVfYmFzZWQgdG8gYSBSYXRlTGltaXRSdWxlOyBieXRlX21hdGNoIHRvIGEgbWF0Y2hfY29uZGl0aW9uIHdpdGggYSB0eXBlZCB2YXJpYWJsZTsgZ2VvX21hdGNoIHRvIGEgR2VvTWF0Y2ggcnVsZTsgbWFuYWdlZF9ydWxlX2dyb3VwIHRvIHRoZSBPV0FTUCBtYW5hZ2VkIHJ1bGUgc2V0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3YTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5BV1MgV0FGdjIgU1RBVEVNRU5UPC90ZXh0Pgo8dGV4dCB4PSI1MTYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5BWlVSRSBXQUYgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMzgiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmlwX3NldF9yZWZlcmVuY2Vfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iNTUiIHgyPSI1MDYiIHkyPSI1NSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd2EzKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjUxMCIgeT0iMzgiIHdpZHRoPSIzMDYiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MjQiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5SZW1vdGVBZGRyIElQTWF0Y2ggwrcgQ0lEUnMgaW5saW5lPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iODAiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iMTAyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5yYXRlX2Jhc2VkX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9Ijk3IiB4Mj0iNTA2IiB5Mj0iOTciIHN0cm9rZS13aWR0aD0iMS43IiBtYXJrZXItZW5kPSJ1cmwoI3dhMykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1MTAiIHk9IjgwIiB3aWR0aD0iMzA2IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNTI0IiB5PSIxMDIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPlJhdGVMaW1pdFJ1bGUgwrcgT25lTWluIC8gRml2ZU1pbnM8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxMjIiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5ieXRlX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjEzOSIgeDI9IjUwNiIgeTI9IjEzOSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd2EzKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjUxMCIgeT0iMTIyIiB3aWR0aD0iMzA2IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNTI0IiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPm1hdGNoX2NvbmRpdGlvbiDCtyBSZXF1ZXN0VXJpLCDigKY8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxNjQiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iMTg2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5nZW9fbWF0Y2hfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iMTgxIiB4Mj0iNTA2IiB5Mj0iMTgxIiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3YTMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTEwIiB5PSIxNjQiIHdpZHRoPSIzMDYiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MjQiIHk9IjE4NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNyI+R2VvTWF0Y2ggwrcgY291bnRyeSBjb2RlczwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjIwNiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM0IiB5PSIyMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPm1hbmFnZWRfcnVsZV9ncm91cF9zdGF0ZW1lbnQ8L3RleHQ+CjxsaW5lIHgxPSIzMjYiIHkxPSIyMjMiIHgyPSI1MDYiIHkyPSIyMjMiIHN0cm9rZS13aWR0aD0iMS43IiBtYXJrZXItZW5kPSJ1cmwoI3dhMykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1MTAiIHk9IjIwNiIgd2lkdGg9IjMwNiIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojMzczMGEzIi8+Cjx0ZXh0IHg9IjUyNCIgeT0iMjI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojYTViNGZjIj5tYW5hZ2VkX3J1bGVfc2V0IMK3IE9XQVNQIENSUzwvdGV4dD4KPC9zdmc+)

Four statement types become custom rules; AWS managed rule groups map to the OWASP Core Rule Set.

#### IP sets and rate limits

Azure custom rules cannot refer to a separate IP list, so an IP set's CIDRs are copied into the rule's `match_values` with the `RemoteAddr` variable and the `IPMatch` operator. An IP set shared by several web ACLs is copied into each policy, so a change to the list must be made in each one.

A `rate_based_statement` becomes a `RateLimitRule` on the client address, with the AWS request limit as its threshold. Azure accepts only two windows, one minute and five minutes. A 60-second or 300-second window maps exactly; any other window of 60 seconds or less becomes one minute, and anything longer becomes five minutes. The build warns when it rounds.

![An aws\_wafv2\_ip\_set with three CIDRs becomes a custom rule with the RemoteAddr variable and the IPMatch operator, whose match\_values list holds the same three CIDRs.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBhd3Nfd2FmdjJfaXBfc2V0IHdpdGggdGhyZWUgQ0lEUnMgYmVjb21lcyBhIGN1c3RvbSBydWxlIHdpdGggdGhlIFJlbW90ZUFkZHIgdmFyaWFibGUgYW5kIHRoZSBJUE1hdGNoIG9wZXJhdG9yLCB3aG9zZSBtYXRjaF92YWx1ZXMgbGlzdCBob2xkcyB0aGUgc2FtZSB0aHJlZSBDSURScy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2EtaXAtc2V0IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+YXdzX3dhZnYyX2lwX3NldDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjEyOCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0MCIgeT0iNzAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmFkZHJlc3NlcyA9IFs8L3RleHQ+Cjx0ZXh0IHg9IjU2IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+IjIwMy4wLjExMy4wLzI0Iiw8L3RleHQ+Cjx0ZXh0IHg9IjU2IiB5PSIxMTQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPiIxOTguNTEuMTAwLjcvMzIiLDwvdGV4dD4KPHRleHQgeD0iNTYiIHk9IjEzNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+IjEwLjAuMC4wLzgiPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMTU4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5dPC90ZXh0Pgo8dGV4dCB4PSIzMDAiIHk9Ijg2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXdlaWdodDo3MDAiPmlubGluZSBpbnRvPC90ZXh0Pgo8dGV4dCB4PSIzMDAiIHk9IjEwMiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC13ZWlnaHQ6NzAwIj5tYXRjaF92YWx1ZXM8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMDgiIHgyPSIzOTIiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YS1pcC1zZXQpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDIwIiB5PSIyOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+Y3VzdG9tX3J1bGVzICYjMTIzOyBNYXRjaFJ1bGUgJiMxMjU7PC90ZXh0Pgo8cmVjdCB4PSI0MTQiIHk9IjQwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjEyOCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0MzQiIHk9IjcwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij52YXJpYWJsZV9uYW1lID0gIlJlbW90ZUFkZHIiPC90ZXh0Pgo8dGV4dCB4PSI0MzQiIHk9Ijk0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5vcGVyYXRvciAgICAgID0gIklQTWF0Y2giPC90ZXh0Pgo8dGV4dCB4PSI0MzQiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1NyI+bWF0Y2hfdmFsdWVzICA9IFsgdGhlIDMgQ0lEUnMgXTwvdGV4dD4KPHRleHQgeD0iNDM0IiB5PSIxNTAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmFjdGlvbiA9ICJCbG9jayIgICAob3IgQWxsb3cpPC90ZXh0Pgo8L3N2Zz4=)

![An aws\_wafv2\_ip\_set with three CIDRs becomes a custom rule with the RemoteAddr variable and the IPMatch operator, whose match\_values list holds the same three CIDRs.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBhd3Nfd2FmdjJfaXBfc2V0IHdpdGggdGhyZWUgQ0lEUnMgYmVjb21lcyBhIGN1c3RvbSBydWxlIHdpdGggdGhlIFJlbW90ZUFkZHIgdmFyaWFibGUgYW5kIHRoZSBJUE1hdGNoIG9wZXJhdG9yLCB3aG9zZSBtYXRjaF92YWx1ZXMgbGlzdCBob2xkcyB0aGUgc2FtZSB0aHJlZSBDSURScy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0id2EtaXAtc2V0IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+YXdzX3dhZnYyX2lwX3NldDwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQwIiB3aWR0aD0iMjUwIiBoZWlnaHQ9IjEyOCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0MCIgeT0iNzAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmFkZHJlc3NlcyA9IFs8L3RleHQ+Cjx0ZXh0IHg9IjU2IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+IjIwMy4wLjExMy4wLzI0Iiw8L3RleHQ+Cjx0ZXh0IHg9IjU2IiB5PSIxMTQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPiIxOTguNTEuMTAwLjcvMzIiLDwvdGV4dD4KPHRleHQgeD0iNTYiIHk9IjEzNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+IjEwLjAuMC4wLzgiPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMTU4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5dPC90ZXh0Pgo8dGV4dCB4PSIzMDAiIHk9Ijg2IiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXdlaWdodDo3MDAiPmlubGluZSBpbnRvPC90ZXh0Pgo8dGV4dCB4PSIzMDAiIHk9IjEwMiIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC13ZWlnaHQ6NzAwIj5tYXRjaF92YWx1ZXM8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMDgiIHgyPSIzOTIiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3YS1pcC1zZXQpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDIwIiB5PSIyOCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+Y3VzdG9tX3J1bGVzICYjMTIzOyBNYXRjaFJ1bGUgJiMxMjU7PC90ZXh0Pgo8cmVjdCB4PSI0MTQiIHk9IjQwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjEyOCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0MzQiIHk9IjcwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij52YXJpYWJsZV9uYW1lID0gIlJlbW90ZUFkZHIiPC90ZXh0Pgo8dGV4dCB4PSI0MzQiIHk9Ijk0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5vcGVyYXRvciAgICAgID0gIklQTWF0Y2giPC90ZXh0Pgo8dGV4dCB4PSI0MzQiIHk9IjExOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNyI+bWF0Y2hfdmFsdWVzICA9IFsgdGhlIDMgQ0lEUnMgXTwvdGV4dD4KPHRleHQgeD0iNDM0IiB5PSIxNTAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmFjdGlvbiA9ICJCbG9jayIgICAob3IgQWxsb3cpPC90ZXh0Pgo8L3N2Zz4=)

The IP set's CIDRs are written into the custom rule itself; there is no separate list resource.

#### Managed rules, scope and the default action

**Managed rule groups.** AWS managed rule groups map to the OWASP Core Rule Set that Microsoft ships with the Application Gateway WAF, so injection, cross-site scripting and protocol-violation coverage is kept. The individual rule IDs differ; see Limitations.

**Scope.** A `REGIONAL` web ACL maps directly. A `CLOUDFRONT` web ACL is also created as an Application Gateway policy; for a global edge, Azure's equivalent is Front Door, which the build names in a warning.

**Default action.** A default action of allow maps exactly. A default of block does not, because Azure has no policy-wide default deny; see Limitations.

#### Limitations

Where AWS WAF and the Azure WAF policy differ

* **Regex, SQLi, XSS, size, label and composite statements are not supported.** Regex, size-constraint, SQL-injection and XSS match statements, label matches and and / or / not composites create no rule; the build names each one. You can cover injection and cross-site checks with the OWASP rules, and re-create a regex check as an Azure custom rule with the `Regex` operator.
* **A default block action behaves differently: unmatched requests are allowed.** The allow rules are created, but a request that matches no rule still passes. Add an explicit lowest-priority block rule to restore deny-by-default.
* **Rate windows behave differently: they round to one or five minutes.** A window other than 60 or 300 seconds is rounded, which changes the effective rate.
* **Rate-limit scope-down statements are not supported.** A `scope_down_statement` is dropped, so the limit applies to all traffic the rule matches. Add a match condition to narrow it again.
* **AWS managed rule IDs are not supported.** Managed groups map to OWASP Core Rule Set 3.2 as a whole. Per-rule action overrides and excluded rules are dropped; re-create them as OWASP exclusions.
* **An OWASP baseline is added when you had no managed group.** Azure requires a managed rule set, so a web ACL with only custom rules gains OWASP Core Rule Set 3.2. It can block traffic your web ACL allowed; check it before taking traffic.
* **The compress-whitespace transformation is not supported.** Azure has no equivalent, so a byte match that used it compares the raw value. Lowercase, URL-decode and HTML-entity-decode are kept.
* **Rules the build cannot read behave differently: they never become allows.** A rule whose action comes from a variable is created as `Block`. An IP set whose addresses come from a variable creates no rule. Rules generated by a `dynamic "rule"` block are not translated. The build warns about each.

#### Other considerations

* **Attach the policy to your gateway.** Associate the WAF policy with the Application Gateway in front of the workload. Until then it protects nothing.
* **Enforcement starts immediately.** The policy runs in Prevention mode. If you want a trial period, switch it to Detection mode in the Azure portal first.
* **Logging is on the gateway.** WAF request logs are a diagnostic setting on the Application Gateway, not part of the policy. Enable them there.
* **References to the web ACL.** References to its `id` or `name` now point to the WAF policy. A policy has no ARN, so an output that reads the ARN is removed with a warning, and any other ARN reference stops the build with an error.
* **Keep the WAF resources in one module.** If the `aws_wafv2_*` resources span more than one module, the build stops with an error.
* **Azure limits differ.** The Application Gateway WAF limits the number of custom rules and the size of match values differently from AWS. Check a very large IP set or rule set against the Azure limits.

## On OCI

### OCI Web Application Firewall

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Default action (deny-by-default) | Default action | Supported | Most usage | the access-control module has its own default action, so both a default of allow and a deny-by-default allowlist map cleanly |
| IP-set allow / block | IP sets | Partial | Common | each ip-set → an oci\_waf\_network\_address\_list holding its CIDRs; the source-address to list access-control condition is a best-effort JMESPATH expression, verified at the build |
| Logging configuration | Logging | Partial | Full surface | WAF logging is configured on the OCI enforcement point rather than a per-web-ACL logging configuration |
| AWS managed rule groups | Managed rules | Partial | Most usage | managed\_rule\_group → a request\_protection OWASP Core Rule Set protection capability; the catalogs differ, so a specific AWS-managed rule id does not port 1:1 |
| Byte-match / geo-match | Match conditions | Partial | Most usage | → request\_access\_control rules; OCI's JMESPATH condition language differs from AWS field\_to\_match, so the byte and country conditions become best-effort expressions to verify |
| Regex / SQLi / XSS / size / label / composite statements | Match conditions | Out of scope | Full surface | not translated to rules; re-express injection and cross-site checks through the OWASP protection capabilities |
| Rate-based rules | Rate limiting | Supported | Common | → a request\_rate\_limiting rule with requests\_limit and period\_in\_seconds; the AWS evaluation window maps unrounded |
| Rule groups | Rule groups | Partial | Most usage | a reusable rule-group's inlined statements translate with their parent web ACL; a standalone rule-group resource is not emitted on its own |
| Web ACL rule tree | Web ACL | Supported | Common | the aws\_wafv2\_web\_acl rule tree is emitted as an oci\_waf\_web\_app\_firewall\_policy with named actions and access-control / rate-limiting / protection rule modules, evaluated by Oracle's WAF engine |

#### How it works

On AWS, an `aws_wafv2_web_acl` holds rules that AWS WAF evaluates in front of an ALB or a CloudFront distribution: IP-set lists, rate-based rules, byte-match and geo-match conditions, and AWS managed rule groups. On OCI, the equivalent is the OCI Web Application Firewall, whose rules live in an `oci_waf_web_app_firewall_policy`.

When the stack is built, the web ACL becomes one OCI WAF policy, and each IP set becomes an `oci_waf_network_address_list`. Request conditions are written in OCI's JMESPATH condition language, and AWS managed rule groups map to OCI's OWASP-based protection. You attach the policy to a load balancer or gateway, and OCI's WAF evaluates every request; Tensor9 is not in the request path. Several conditions are approximations, described below, and the build warns about each one so you can check it.

![On AWS, AWS WAF enforces the aws\_wafv2\_web\_acl rules. On OCI, the build turns the same rules into an oci\_waf\_web\_app\_firewall\_policy, plus a network address list for each IP set, and OCI's WAF evaluates the policy.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgyIiB2aWV3Qm94PSIwIDAgODM2IDE4MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFXUyBXQUYgZW5mb3JjZXMgdGhlIGF3c193YWZ2Ml93ZWJfYWNsIHJ1bGVzLiBPbiBPQ0ksIHRoZSBidWlsZCB0dXJucyB0aGUgc2FtZSBydWxlcyBpbnRvIGFuIG9jaV93YWZfd2ViX2FwcF9maXJld2FsbF9wb2xpY3ksIHBsdXMgYSBuZXR3b3JrIGFkZHJlc3MgbGlzdCBmb3IgZWFjaCBJUCBzZXQsIGFuZCBPQ0kncyBXQUYgZXZhbHVhdGVzIHRoZSBwb2xpY3kuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9IndvMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDQiIHdpZHRoPSIzNTYiIGhlaWdodD0iMTIyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMDUiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+YXdzX3dhZnYyX3dlYl9hY2w8L3RleHQ+Cjx0ZXh0IHg9IjEwNSIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cnVsZXMgKyBpcC1zZXRzPC90ZXh0Pgo8bGluZSB4MT0iMTgwIiB5MT0iMTE0IiB4Mj0iMjI2IiB5Mj0iMTE0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28xKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjIwMyIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5lbmZvcmNlZDwvdGV4dD4KPHJlY3QgeD0iMjMwIiB5PSI3OCIgd2lkdGg9IjEyOCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyOTQiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgV0FGPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFMQiAvIENsb3VkRnJvbnQ8L3RleHQ+CjxsaW5lIHgxPSI0MTQiIHkxPSIzOCIgeDI9IjQxNCIgeTI9IjE2MiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0NTYiIHk9IjQ0IiB3aWR0aD0iMzY4IiBoZWlnaHQ9IjEyMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ3MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDcwIiB5PSI3OCIgd2lkdGg9IjEyNiIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MzMiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPnNhbWUgcnVsZSB0cmVlPC90ZXh0Pgo8dGV4dCB4PSI1MzMiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+dHJhbnNsYXRlZCBieSB0aGUgYnVpbGQ8L3RleHQ+CjxsaW5lIHgxPSI1OTYiIHkxPSIxMTQiIHgyPSI2NDIiIHkyPSIxMTQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3bzEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNjQ2IiB5PSI3MiIgd2lkdGg9IjE2OCIgaGVpZ2h0PSI4NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MzAiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPldBRiBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjczMCIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+b2NpX3dhZl93ZWJfYXBwPC90ZXh0Pgo8dGV4dCB4PSI3MzAiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPisgbmV0d29yayBhZGRyZXNzIGxpc3Q8L3RleHQ+Cjwvc3ZnPg==)

![On AWS, AWS WAF enforces the aws\_wafv2\_web\_acl rules. On OCI, the build turns the same rules into an oci\_waf\_web\_app\_firewall\_policy, plus a network address list for each IP set, and OCI's WAF evaluates the policy.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgyIiB2aWV3Qm94PSIwIDAgODM2IDE4MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFXUyBXQUYgZW5mb3JjZXMgdGhlIGF3c193YWZ2Ml93ZWJfYWNsIHJ1bGVzLiBPbiBPQ0ksIHRoZSBidWlsZCB0dXJucyB0aGUgc2FtZSBydWxlcyBpbnRvIGFuIG9jaV93YWZfd2ViX2FwcF9maXJld2FsbF9wb2xpY3ksIHBsdXMgYSBuZXR3b3JrIGFkZHJlc3MgbGlzdCBmb3IgZWFjaCBJUCBzZXQsIGFuZCBPQ0kncyBXQUYgZXZhbHVhdGVzIHRoZSBwb2xpY3kuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9IndvMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDQiIHdpZHRoPSIzNTYiIGhlaWdodD0iMTIyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3OCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMDUiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+YXdzX3dhZnYyX3dlYl9hY2w8L3RleHQ+Cjx0ZXh0IHg9IjEwNSIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cnVsZXMgKyBpcC1zZXRzPC90ZXh0Pgo8bGluZSB4MT0iMTgwIiB5MT0iMTE0IiB4Mj0iMjI2IiB5Mj0iMTE0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28xKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjIwMyIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5lbmZvcmNlZDwvdGV4dD4KPHJlY3QgeD0iMjMwIiB5PSI3OCIgd2lkdGg9IjEyOCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyOTQiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgV0FGPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFMQiAvIENsb3VkRnJvbnQ8L3RleHQ+CjxsaW5lIHgxPSI0MTQiIHkxPSIzOCIgeDI9IjQxNCIgeTI9IjE2MiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0NTYiIHk9IjQ0IiB3aWR0aD0iMzY4IiBoZWlnaHQ9IjEyMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ3MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDcwIiB5PSI3OCIgd2lkdGg9IjEyNiIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI1MzMiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPnNhbWUgcnVsZSB0cmVlPC90ZXh0Pgo8dGV4dCB4PSI1MzMiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+dHJhbnNsYXRlZCBieSB0aGUgYnVpbGQ8L3RleHQ+CjxsaW5lIHgxPSI1OTYiIHkxPSIxMTQiIHgyPSI2NDIiIHkyPSIxMTQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3bzEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNjQ2IiB5PSI3MiIgd2lkdGg9IjE2OCIgaGVpZ2h0PSI4NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MzAiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPldBRiBwb2xpY3k8L3RleHQ+Cjx0ZXh0IHg9IjczMCIgeT0iMTE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+b2NpX3dhZl93ZWJfYXBwPC90ZXh0Pgo8dGV4dCB4PSI3MzAiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPisgbmV0d29yayBhZGRyZXNzIGxpc3Q8L3RleHQ+Cjwvc3ZnPg==)

The build turns your web ACL into an OCI WAF policy, plus an address list for each IP set.

#### What the build creates

OCI names a policy's actions once and has each rule refer to one by name. The build creates three: an allow action, a block action that returns HTTP 403, and a check action that logs the match and lets the request continue. AWS allow, block and count map to allow, block and check.

Rules are grouped by what they inspect: access-control rules (IP-set, byte-match and geo-match), rate-limiting rules, and protection rules (the managed OWASP capabilities). The policy and its address lists are created in the stack's compartment. The build does not attach the policy, even if the stack had an `aws_wafv2_web_acl_association`; you attach it, as you attached the web ACL on AWS.

![The policy declares three named actions (allowAction, blockAction, checkAction) and three rule modules: request access control for IP, byte and geo rules; request rate limiting for rate rules; request protection for managed groups. Each ip-set is a separate network address list. The policy is created in the stack's compartment.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgcG9saWN5IGRlY2xhcmVzIHRocmVlIG5hbWVkIGFjdGlvbnMgKGFsbG93QWN0aW9uLCBibG9ja0FjdGlvbiwgY2hlY2tBY3Rpb24pIGFuZCB0aHJlZSBydWxlIG1vZHVsZXM6IHJlcXVlc3QgYWNjZXNzIGNvbnRyb2wgZm9yIElQLCBieXRlIGFuZCBnZW8gcnVsZXM7IHJlcXVlc3QgcmF0ZSBsaW1pdGluZyBmb3IgcmF0ZSBydWxlczsgcmVxdWVzdCBwcm90ZWN0aW9uIGZvciBtYW5hZ2VkIGdyb3Vwcy4gRWFjaCBpcC1zZXQgaXMgYSBzZXBhcmF0ZSBuZXR3b3JrIGFkZHJlc3MgbGlzdC4gVGhlIHBvbGljeSBpcyBjcmVhdGVkIGluIHRoZSBzdGFjaydzIGNvbXBhcnRtZW50LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3bzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5USEUgU1RBQ0snUyBPQ0kgV0FGIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjE3NiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI5NSIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+bmFtZWQgYWN0aW9uczwvdGV4dD4KPHRleHQgeD0iOTUiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5hbGxvd0FjdGlvbjwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6I2I0NTMwOSI+YmxvY2tBY3Rpb248L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmNoZWNrQWN0aW9uPC90ZXh0Pgo8dGV4dCB4PSI5NSIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cmVmZXJlbmNlZCBieTwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjE5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmV2ZXJ5IHJ1bGU8L3RleHQ+CjxsaW5lIHgxPSIxNzAiIHkxPSI4MCIgeDI9IjIxMiIgeTI9IjcyIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28yKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxsaW5lIHgxPSIxNzAiIHkxPSIxMjgiIHgyPSIyMTIiIHkyPSIxMjgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3bzIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPGxpbmUgeDE9IjE3MCIgeTE9IjE3NiIgeDI9IjIxMiIgeTI9IjE4NCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dvMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMTYiIHk9IjQ4IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjM2NiIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPnJlcXVlc3RfYWNjZXNzX2NvbnRyb2w8L3RleHQ+Cjx0ZXh0IHg9IjM2NiIgeT0iODUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPklQIMK3IGJ5dGUgwrcgZ2VvIHJ1bGVzPC90ZXh0Pgo8cmVjdCB4PSIyMTYiIHk9IjEwNiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNjYiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+cmVxdWVzdF9yYXRlX2xpbWl0aW5nPC90ZXh0Pgo8dGV4dCB4PSIzNjYiIHk9IjE0MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnJhdGUgcnVsZXMsIHNhbWUgd2luZG93IGFzIEFXUzwvdGV4dD4KPHJlY3QgeD0iMjE2IiB5PSIxNjQiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNlZWYyZmY7c3Ryb2tlOiNjN2QyZmUiLz4KPHRleHQgeD0iMzY2IiB5PSIxODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiM0ZjQ2ZTUiPnJlcXVlc3RfcHJvdGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iMzY2IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5PV0FTUCBDUlMgY2FwYWJpbGl0aWVzPC90ZXh0Pgo8bGluZSB4MT0iNTE2IiB5MT0iMTI4IiB4Mj0iNTYwIiB5Mj0iMTI4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28yKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU2NCIgeT0iNzAiIHdpZHRoPSIxMjAiIGhlaWdodD0iNTIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjI0IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHgiPm5ldHdvcms8L3RleHQ+Cjx0ZXh0IHg9IjYyNCIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEwLjVweCI+YWRkcmVzcyBsaXN0PC90ZXh0Pgo8dGV4dCB4PSI2MjQiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPm9uZSBwZXIgaXAtc2V0PC90ZXh0Pgo8cmVjdCB4PSI3MDAiIHk9IjcwIiB3aWR0aD0iMTE2IiBoZWlnaHQ9IjUyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijc1OCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5sb2FkIGJhbGFuY2VyPC90ZXh0Pgo8dGV4dCB4PSI3NTgiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnlvdSBhdHRhY2ggdGhlIHBvbGljeTwvdGV4dD4KPC9zdmc+)

![The policy declares three named actions (allowAction, blockAction, checkAction) and three rule modules: request access control for IP, byte and geo rules; request rate limiting for rate rules; request protection for managed groups. Each ip-set is a separate network address list. The policy is created in the stack's compartment.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgcG9saWN5IGRlY2xhcmVzIHRocmVlIG5hbWVkIGFjdGlvbnMgKGFsbG93QWN0aW9uLCBibG9ja0FjdGlvbiwgY2hlY2tBY3Rpb24pIGFuZCB0aHJlZSBydWxlIG1vZHVsZXM6IHJlcXVlc3QgYWNjZXNzIGNvbnRyb2wgZm9yIElQLCBieXRlIGFuZCBnZW8gcnVsZXM7IHJlcXVlc3QgcmF0ZSBsaW1pdGluZyBmb3IgcmF0ZSBydWxlczsgcmVxdWVzdCBwcm90ZWN0aW9uIGZvciBtYW5hZ2VkIGdyb3Vwcy4gRWFjaCBpcC1zZXQgaXMgYSBzZXBhcmF0ZSBuZXR3b3JrIGFkZHJlc3MgbGlzdC4gVGhlIHBvbGljeSBpcyBjcmVhdGVkIGluIHRoZSBzdGFjaydzIGNvbXBhcnRtZW50LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3bzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5USEUgU1RBQ0snUyBPQ0kgV0FGIFBPTElDWTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjQyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjE3NiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI5NSIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+bmFtZWQgYWN0aW9uczwvdGV4dD4KPHRleHQgeD0iOTUiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5hbGxvd0FjdGlvbjwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2ZiYmYyNCI+YmxvY2tBY3Rpb248L3RleHQ+Cjx0ZXh0IHg9Ijk1IiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmNoZWNrQWN0aW9uPC90ZXh0Pgo8dGV4dCB4PSI5NSIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cmVmZXJlbmNlZCBieTwvdGV4dD4KPHRleHQgeD0iOTUiIHk9IjE5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmV2ZXJ5IHJ1bGU8L3RleHQ+CjxsaW5lIHgxPSIxNzAiIHkxPSI4MCIgeDI9IjIxMiIgeTI9IjcyIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28yKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxsaW5lIHgxPSIxNzAiIHkxPSIxMjgiIHgyPSIyMTIiIHkyPSIxMjgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN3bzIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPGxpbmUgeDE9IjE3MCIgeTE9IjE3NiIgeDI9IjIxMiIgeTI9IjE4NCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dvMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMTYiIHk9IjQ4IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjM2NiIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPnJlcXVlc3RfYWNjZXNzX2NvbnRyb2w8L3RleHQ+Cjx0ZXh0IHg9IjM2NiIgeT0iODUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPklQIMK3IGJ5dGUgwrcgZ2VvIHJ1bGVzPC90ZXh0Pgo8cmVjdCB4PSIyMTYiIHk9IjEwNiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNjYiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+cmVxdWVzdF9yYXRlX2xpbWl0aW5nPC90ZXh0Pgo8dGV4dCB4PSIzNjYiIHk9IjE0MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnJhdGUgcnVsZXMsIHNhbWUgd2luZG93IGFzIEFXUzwvdGV4dD4KPHJlY3QgeD0iMjE2IiB5PSIxNjQiIHdpZHRoPSIzMDAiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTFiNGI7c3Ryb2tlOiMzNzMwYTMiLz4KPHRleHQgeD0iMzY2IiB5PSIxODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNhNWI0ZmMiPnJlcXVlc3RfcHJvdGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iMzY2IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5PV0FTUCBDUlMgY2FwYWJpbGl0aWVzPC90ZXh0Pgo8bGluZSB4MT0iNTE2IiB5MT0iMTI4IiB4Mj0iNTYwIiB5Mj0iMTI4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd28yKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU2NCIgeT0iNzAiIHdpZHRoPSIxMjAiIGhlaWdodD0iNTIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjI0IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHgiPm5ldHdvcms8L3RleHQ+Cjx0ZXh0IHg9IjYyNCIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEwLjVweCI+YWRkcmVzcyBsaXN0PC90ZXh0Pgo8dGV4dCB4PSI2MjQiIHk9IjE1MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPm9uZSBwZXIgaXAtc2V0PC90ZXh0Pgo8cmVjdCB4PSI3MDAiIHk9IjcwIiB3aWR0aD0iMTE2IiBoZWlnaHQ9IjUyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijc1OCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5sb2FkIGJhbGFuY2VyPC90ZXh0Pgo8dGV4dCB4PSI3NTgiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnlvdSBhdHRhY2ggdGhlIHBvbGljeTwvdGV4dD4KPC9zdmc+)

The policy names three actions once, and groups rules into access control, rate limiting and protection.

#### How the rule statements translate

A `rate_based_statement` becomes a rate-limiting rule with the AWS limit as `requests_limit` and the AWS window as `period_in_seconds`, unchanged. A request over the limit gets the block action's HTTP 403.

A `byte_match_statement` becomes an access-control rule whose condition checks whether the URL path contains the search string. That is the condition for every byte match, whatever field and positional constraint the AWS rule used. A `geo_match_statement` becomes an access-control rule that compares the request's `x-country` header with the country codes. Check both kinds of condition before the policy takes traffic.

![ip\_set\_reference becomes a network address list plus an access-control rule; rate\_based becomes a rate-limiting rule with the same window; byte\_match becomes an access-control rule that checks the URL path; geo\_match becomes an access-control rule on the x-country header; managed\_rule\_group becomes an OWASP protection rule.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJpcF9zZXRfcmVmZXJlbmNlIGJlY29tZXMgYSBuZXR3b3JrIGFkZHJlc3MgbGlzdCBwbHVzIGFuIGFjY2Vzcy1jb250cm9sIHJ1bGU7IHJhdGVfYmFzZWQgYmVjb21lcyBhIHJhdGUtbGltaXRpbmcgcnVsZSB3aXRoIHRoZSBzYW1lIHdpbmRvdzsgYnl0ZV9tYXRjaCBiZWNvbWVzIGFuIGFjY2Vzcy1jb250cm9sIHJ1bGUgdGhhdCBjaGVja3MgdGhlIFVSTCBwYXRoOyBnZW9fbWF0Y2ggYmVjb21lcyBhbiBhY2Nlc3MtY29udHJvbCBydWxlIG9uIHRoZSB4LWNvdW50cnkgaGVhZGVyOyBtYW5hZ2VkX3J1bGVfZ3JvdXAgYmVjb21lcyBhbiBPV0FTUCBwcm90ZWN0aW9uIHJ1bGUuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9IndvMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPkFXUyBXQUZ2MiBTVEFURU1FTlQ8L3RleHQ+Cjx0ZXh0IHg9IjUxMiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9DSSBXQUYgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMzgiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmlwX3NldF9yZWZlcmVuY2Vfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iNTUiIHgyPSI1MDIiIHkyPSI1NSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjUwNiIgeT0iMzgiIHdpZHRoPSIzMTAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSI1MjAiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5hZGRyZXNzIGxpc3QgKyBhY2Nlc3MgcnVsZTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjgwIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzQiIHk9IjEwMiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+cmF0ZV9iYXNlZF9zdGF0ZW1lbnQ8L3RleHQ+CjxsaW5lIHgxPSIzMjYiIHkxPSI5NyIgeDI9IjUwMiIgeTI9Ijk3IiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3bzMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTA2IiB5PSI4MCIgd2lkdGg9IjMxMCIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjUyMCIgeT0iMTAyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5yZXF1ZXN0X3JhdGVfbGltaXRpbmcgwrcgc2FtZSB3aW5kb3c8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxMjIiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5ieXRlX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjEzOSIgeDI9IjUwMiIgeTI9IjEzOSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjUwNiIgeT0iMTIyIiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmZGU2OGEiLz4KPHRleHQgeD0iNTIwIiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiNiNDUzMDkiPmFjY2VzcyBydWxlIMK3IFVSTCBwYXRoIGNvbnRhaW5zPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMTY0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzQiIHk9IjE4NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+Z2VvX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjE4MSIgeDI9IjUwMiIgeTI9IjE4MSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjUwNiIgeT0iMTY0IiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmZGU2OGEiLz4KPHRleHQgeD0iNTIwIiB5PSIxODYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiNiNDUzMDkiPmFjY2VzcyBydWxlIMK3IHgtY291bnRyeSBoZWFkZXI8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIyMDYiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNCIgeT0iMjI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5tYW5hZ2VkX3J1bGVfZ3JvdXBfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iMjIzIiB4Mj0iNTAyIiB5Mj0iMjIzIiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3bzMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTA2IiB5PSIyMDYiIHdpZHRoPSIzMTAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2VlZjJmZjtzdHJva2U6I2M3ZDJmZSIvPgo8dGV4dCB4PSI1MjAiIHk9IjIyOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzRmNDZlNSI+cmVxdWVzdF9wcm90ZWN0aW9uIMK3IE9XQVNQIENSUzwvdGV4dD4KPC9zdmc+)

![ip\_set\_reference becomes a network address list plus an access-control rule; rate\_based becomes a rate-limiting rule with the same window; byte\_match becomes an access-control rule that checks the URL path; geo\_match becomes an access-control rule on the x-country header; managed\_rule\_group becomes an OWASP protection rule.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJpcF9zZXRfcmVmZXJlbmNlIGJlY29tZXMgYSBuZXR3b3JrIGFkZHJlc3MgbGlzdCBwbHVzIGFuIGFjY2Vzcy1jb250cm9sIHJ1bGU7IHJhdGVfYmFzZWQgYmVjb21lcyBhIHJhdGUtbGltaXRpbmcgcnVsZSB3aXRoIHRoZSBzYW1lIHdpbmRvdzsgYnl0ZV9tYXRjaCBiZWNvbWVzIGFuIGFjY2Vzcy1jb250cm9sIHJ1bGUgdGhhdCBjaGVja3MgdGhlIFVSTCBwYXRoOyBnZW9fbWF0Y2ggYmVjb21lcyBhbiBhY2Nlc3MtY29udHJvbCBydWxlIG9uIHRoZSB4LWNvdW50cnkgaGVhZGVyOyBtYW5hZ2VkX3J1bGVfZ3JvdXAgYmVjb21lcyBhbiBPV0FTUCBwcm90ZWN0aW9uIHJ1bGUuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9IndvMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPkFXUyBXQUZ2MiBTVEFURU1FTlQ8L3RleHQ+Cjx0ZXh0IHg9IjUxMiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9DSSBXQUYgUE9MSUNZPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMzgiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iNjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmlwX3NldF9yZWZlcmVuY2Vfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iNTUiIHgyPSI1MDIiIHkyPSI1NSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjUwNiIgeT0iMzgiIHdpZHRoPSIzMTAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MjAiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5hZGRyZXNzIGxpc3QgKyBhY2Nlc3MgcnVsZTwvdGV4dD4KPHJlY3QgeD0iMjAiIHk9IjgwIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzQiIHk9IjEwMiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+cmF0ZV9iYXNlZF9zdGF0ZW1lbnQ8L3RleHQ+CjxsaW5lIHgxPSIzMjYiIHkxPSI5NyIgeDI9IjUwMiIgeTI9Ijk3IiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3bzMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTA2IiB5PSI4MCIgd2lkdGg9IjMxMCIgaGVpZ2h0PSIzNCIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjUyMCIgeT0iMTAyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5yZXF1ZXN0X3JhdGVfbGltaXRpbmcgwrcgc2FtZSB3aW5kb3c8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIxMjIiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5ieXRlX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjEzOSIgeDI9IjUwMiIgeTI9IjEzOSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjUwNiIgeT0iMTIyIiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiM5MjQwMGUiLz4KPHRleHQgeD0iNTIwIiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNmYmJmMjQiPmFjY2VzcyBydWxlIMK3IFVSTCBwYXRoIGNvbnRhaW5zPC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iMTY0IiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzQiIHk9IjE4NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+Z2VvX21hdGNoX3N0YXRlbWVudDwvdGV4dD4KPGxpbmUgeDE9IjMyNiIgeTE9IjE4MSIgeDI9IjUwMiIgeTI9IjE4MSIgc3Ryb2tlLXdpZHRoPSIxLjciIG1hcmtlci1lbmQ9InVybCgjd28zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjUwNiIgeT0iMTY0IiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiM5MjQwMGUiLz4KPHRleHQgeD0iNTIwIiB5PSIxODYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNmYmJmMjQiPmFjY2VzcyBydWxlIMK3IHgtY291bnRyeSBoZWFkZXI8L3RleHQ+CjxyZWN0IHg9IjIwIiB5PSIyMDYiIHdpZHRoPSIzMDAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNCIgeT0iMjI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5tYW5hZ2VkX3J1bGVfZ3JvdXBfc3RhdGVtZW50PC90ZXh0Pgo8bGluZSB4MT0iMzI2IiB5MT0iMjIzIiB4Mj0iNTAyIiB5Mj0iMjIzIiBzdHJva2Utd2lkdGg9IjEuNyIgbWFya2VyLWVuZD0idXJsKCN3bzMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTA2IiB5PSIyMDYiIHdpZHRoPSIzMTAiIGhlaWdodD0iMzQiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMWI0YjtzdHJva2U6IzM3MzBhMyIvPgo8dGV4dCB4PSI1MjAiIHk9IjIyOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2E1YjRmYyI+cmVxdWVzdF9wcm90ZWN0aW9uIMK3IE9XQVNQIENSUzwvdGV4dD4KPC9zdmc+)

IP-set and rate rules map closely; byte-match and geo-match conditions are approximations to check.

#### IP sets and address lists

Each IP set becomes an `oci_waf_network_address_list` of type `ADDRESSES` holding the same CIDRs. The access-control rule for an IP-set statement does not refer to that list: its JMESPATH condition lists the CIDRs itself and compares them with the client address. A change to the IP set therefore has to be made in the rule's condition, not only in the address list.

This condition is an approximation of the AWS IP-set match, and the build warns about it. Confirm that it matches the addresses you expect before the policy enforces.

![An aws\_wafv2\_ip\_set becomes an oci\_waf\_network\_address\_list of type ADDRESSES holding the same CIDRs. The access-control rule does not refer to the list; its JMESPATH condition lists the CIDRs itself and compares them with the client address.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBhd3Nfd2FmdjJfaXBfc2V0IGJlY29tZXMgYW4gb2NpX3dhZl9uZXR3b3JrX2FkZHJlc3NfbGlzdCBvZiB0eXBlIEFERFJFU1NFUyBob2xkaW5nIHRoZSBzYW1lIENJRFJzLiBUaGUgYWNjZXNzLWNvbnRyb2wgcnVsZSBkb2VzIG5vdCByZWZlciB0byB0aGUgbGlzdDsgaXRzIEpNRVNQQVRIIGNvbmRpdGlvbiBsaXN0cyB0aGUgQ0lEUnMgaXRzZWxmIGFuZCBjb21wYXJlcyB0aGVtIHdpdGggdGhlIGNsaWVudCBhZGRyZXNzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3bzQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5hd3Nfd2FmdjJfaXBfc2V0PC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iNDAiIHdpZHRoPSIyMjgiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM4IiB5PSI3MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+YWRkcmVzc2VzID0gWzwvdGV4dD4KPHRleHQgeD0iNTQiIHk9Ijk2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij4iMjAzLjAuMTEzLjAvMjQiLDwvdGV4dD4KPHRleHQgeD0iNTQiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+IjE5OC41MS4xMDAuNy8zMiI8L3RleHQ+Cjx0ZXh0IHg9IjM4IiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPl08L3RleHQ+CjxsaW5lIHgxPSIyNTIiIHkxPSI5OCIgeDI9IjMwMCIgeTI9Ijk4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd280KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQyMCIgeT0iMjgiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPm9jaV93YWZfbmV0d29ya19hZGRyZXNzX2xpc3Q8L3RleHQ+CjxyZWN0IHg9IjMwNCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjMyMiIgeT0iNzIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPnR5cGUgICAgICA9ICJBRERSRVNTRVMiPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9Ijk4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3Ij5hZGRyZXNzZXMgPSBbIHRoZSBDSURScyBdPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9IjEzMCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmEgc2VwYXJhdGUgcmVzb3VyY2UsPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9IjE0NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPm5vdCB1c2VkIGJ5IHRoZSBydWxlPC90ZXh0Pgo8bGluZSB4MT0iNTQ4IiB5MT0iOTgiIHgyPSI1ODgiIHkyPSI5OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dvNCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1OTIiIHk9IjQ2IiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MDQiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPmFjY2Vzcy1jb250cm9sIHJ1bGU8L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiICBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojYjQ1MzA5Ij5KTUVTUEFUSCBjb25kaXRpb248L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bGlzdHMgdGhlIENJRFJzIGl0c2VsZjwvdGV4dD4KPHRleHQgeD0iNzA0IiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj52ZXJpZnkgYmVmb3JlIGVuZm9yY2luZzwvdGV4dD4KPC9zdmc+)

![An aws\_wafv2\_ip\_set becomes an oci\_waf\_network\_address\_list of type ADDRESSES holding the same CIDRs. The access-control rule does not refer to the list; its JMESPATH condition lists the CIDRs itself and compares them with the client address.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBhd3Nfd2FmdjJfaXBfc2V0IGJlY29tZXMgYW4gb2NpX3dhZl9uZXR3b3JrX2FkZHJlc3NfbGlzdCBvZiB0eXBlIEFERFJFU1NFUyBob2xkaW5nIHRoZSBzYW1lIENJRFJzLiBUaGUgYWNjZXNzLWNvbnRyb2wgcnVsZSBkb2VzIG5vdCByZWZlciB0byB0aGUgbGlzdDsgaXRzIEpNRVNQQVRIIGNvbmRpdGlvbiBsaXN0cyB0aGUgQ0lEUnMgaXRzZWxmIGFuZCBjb21wYXJlcyB0aGVtIHdpdGggdGhlIGNsaWVudCBhZGRyZXNzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJ3bzQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI4IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5hd3Nfd2FmdjJfaXBfc2V0PC90ZXh0Pgo8cmVjdCB4PSIyMCIgeT0iNDAiIHdpZHRoPSIyMjgiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM4IiB5PSI3MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+YWRkcmVzc2VzID0gWzwvdGV4dD4KPHRleHQgeD0iNTQiIHk9Ijk2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj4iMjAzLjAuMTEzLjAvMjQiLDwvdGV4dD4KPHRleHQgeD0iNTQiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+IjE5OC41MS4xMDAuNy8zMiI8L3RleHQ+Cjx0ZXh0IHg9IjM4IiB5PSIxNDQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPl08L3RleHQ+CjxsaW5lIHgxPSIyNTIiIHkxPSI5OCIgeDI9IjMwMCIgeTI9Ijk4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjd280KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQyMCIgeT0iMjgiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPm9jaV93YWZfbmV0d29ya19hZGRyZXNzX2xpc3Q8L3RleHQ+CjxyZWN0IHg9IjMwNCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjMyMiIgeT0iNzIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPnR5cGUgICAgICA9ICJBRERSRVNTRVMiPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9Ijk4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3Ij5hZGRyZXNzZXMgPSBbIHRoZSBDSURScyBdPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9IjEzMCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmEgc2VwYXJhdGUgcmVzb3VyY2UsPC90ZXh0Pgo8dGV4dCB4PSIzMjIiIHk9IjE0NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPm5vdCB1c2VkIGJ5IHRoZSBydWxlPC90ZXh0Pgo8bGluZSB4MT0iNTQ4IiB5MT0iOTgiIHgyPSI1ODgiIHkyPSI5OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI3dvNCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1OTIiIHk9IjQ2IiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjEwNiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MDQiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPmFjY2Vzcy1jb250cm9sIHJ1bGU8L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiICBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojZmJiZjI0Ij5KTUVTUEFUSCBjb25kaXRpb248L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iMTIyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bGlzdHMgdGhlIENJRFJzIGl0c2VsZjwvdGV4dD4KPHRleHQgeD0iNzA0IiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij52ZXJpZnkgYmVmb3JlIGVuZm9yY2luZzwvdGV4dD4KPC9zdmc+)

Each IP set becomes an address list, and the access-control rule lists the same CIDRs in its own condition.

#### Managed protection and the default action

**Managed rule groups.** Each AWS managed rule group becomes a protection rule using OCI's OWASP Core Rule Set capability, with the block action. Injection, cross-site scripting and protocol-violation coverage is kept. AWS rule IDs do not correspond one to one with OCI capabilities, so alerts and exclusions written for a specific AWS rule must be re-created. You can tune OCI's protection capabilities in the console after the build to remove false positives.

**Default action.** OCI's access-control rules have their own default action, so both AWS defaults map: allow becomes the allow action, and block becomes the block action. A deny-by-default web ACL keeps denying requests that match no rule, with no extra catch-all rule needed.

#### Limitations

Where AWS WAF and the OCI WAF policy differ

* **Regex, SQLi, XSS, size, label and composite statements are not supported.** Regex, size-constraint, SQL-injection and XSS match statements, label matches and and / or / not composites create no rule; the build names each one. You can cover injection and cross-site checks with the OWASP protection, and write other checks as JMESPATH access-control conditions.
* **Byte-match conditions behave differently: they always check the URL path.** Every byte match becomes "the URL path contains the search string", whatever field (header, query string, body) and positional constraint the AWS rule used. Rewrite conditions that matched anything else.
* **Geo-match conditions behave differently: they read an `x-country` header.** The condition compares that request header with the country codes, so it works only if the header is present in your traffic. Verify it against your setup.
* **IP-set conditions behave differently: the rule lists the CIDRs itself.** The address list holds the exact CIDRs, but the rule's condition does not use it and is an approximation. Verify it before enforcing.
* **Text transformations are not supported.** OCI conditions match the raw request value, so lowercase, URL-decode, HTML-entity-decode and compress-whitespace transformations are dropped.
* **Rate-limit scope-down statements are not supported.** A `scope_down_statement` is dropped, so the limit applies to all traffic the rule matches.
* **AWS managed rule IDs are not supported.** Managed groups map to the OWASP capability as a whole. Per-rule action overrides and excluded rules are dropped; re-create them in OCI.
* **Rules the build cannot read behave differently: they never become allows.** A rule action or web ACL default action that comes from a variable becomes the block action. An IP set whose addresses come from a variable creates no rule. Rules generated by a `dynamic "rule"` block are not translated. The build warns about each.

#### Other considerations

* **Attach the policy.** Associate the WAF policy with the load balancer or gateway in front of the workload. Until then it protects nothing.
* **Enforcement starts immediately.** The block action returns HTTP 403 on a match. For a trial period, switch rules to the check action first.
* **Check conditions before taking traffic.** Review the IP-set, byte-match and geo-match conditions in the OCI console once; they are where the translation is approximate.
* **References to the web ACL.** References to its `id` or `name` now point to the WAF policy. A policy has no ARN, so an output that reads the ARN is removed with a warning, and any other ARN reference stops the build with an error.
* **Keep the WAF resources in one module.** If the `aws_wafv2_*` resources span more than one module, the build stops with an error.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::wafv2
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.