{
  "typeName" : "AWS::ElasticLoadBalancingV2::ListenerRule",
  "description" : "Specifies a listener rule. The listener must be associated with an Application Load Balancer. Each rule consists of a priority, one or more actions, and one or more conditions.\n For more information, see [Quotas for your Application Load Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-limits.html) in the *User Guide for Application Load Balancers*.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-elasticloadbalancingv2",
  "additionalProperties" : false,
  "properties" : {
    "ListenerArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the listener."
    },
    "RuleArn" : {
      "type" : "string",
      "description" : ""
    },
    "Actions" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Action"
      },
      "description" : "The actions.\n The rule must include exactly one of the following types of actions: ``forward``, ``fixed-response``, or ``redirect``, and it must be the last action to be performed. If the rule is for an HTTPS listener, it can also optionally include an authentication action."
    },
    "Priority" : {
      "type" : "integer",
      "description" : "The rule priority. A listener can't have multiple rules with the same priority.\n If you try to reorder rules by updating their priorities, do not specify a new priority if an existing rule already uses this priority, as this can cause an error. If you need to reuse a priority with a different rule, you must remove it as a priority first, and then specify it in a subsequent update."
    },
    "Conditions" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/RuleCondition"
      },
      "description" : "The conditions.\n The rule can optionally include up to one of each of the following conditions: ``http-request-method``, ``host-header``, ``path-pattern``, and ``source-ip``. A rule can also optionally include one or more of each of the following conditions: ``http-header`` and ``query-string``."
    },
    "Transforms" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Transform"
      },
      "description" : ""
    },
    "IsDefault" : {
      "type" : "boolean",
      "description" : ""
    }
  },
  "definitions" : {
    "TargetGroupTuple" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "TargetGroupArn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of the target group."
        },
        "Weight" : {
          "type" : "integer",
          "description" : "The weight. The range is 0 to 999."
        }
      },
      "description" : "Information about how traffic will be distributed between multiple target groups in a forward rule."
    },
    "Action" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Order" : {
          "type" : "integer",
          "description" : "The order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first."
        },
        "TargetGroupArn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of the target group. Specify only when ``Type`` is ``forward`` and you want to route to a single target group. To route to multiple target groups, you must use ``ForwardConfig`` instead."
        },
        "FixedResponseConfig" : {
          "$ref" : "#/definitions/FixedResponseConfig",
          "description" : "[Application Load Balancer] Information for creating an action that returns a custom HTTP response. Specify only when ``Type`` is ``fixed-response``."
        },
        "AuthenticateCognitoConfig" : {
          "$ref" : "#/definitions/AuthenticateCognitoConfig",
          "description" : "[HTTPS listeners] Information for using Amazon Cognito to authenticate users. Specify only when ``Type`` is ``authenticate-cognito``."
        },
        "Type" : {
          "type" : "string",
          "description" : "The type of action."
        },
        "RedirectConfig" : {
          "$ref" : "#/definitions/RedirectConfig",
          "description" : "[Application Load Balancer] Information for creating a redirect action. Specify only when ``Type`` is ``redirect``."
        },
        "ForwardConfig" : {
          "$ref" : "#/definitions/ForwardConfig",
          "description" : "Information for creating an action that distributes requests among multiple target groups. Specify only when ``Type`` is ``forward``.\n If you specify both ``ForwardConfig`` and ``TargetGroupArn``, you can specify only one target group using ``ForwardConfig`` and it must be the same target group specified in ``TargetGroupArn``."
        },
        "AuthenticateOidcConfig" : {
          "$ref" : "#/definitions/AuthenticateOidcConfig",
          "description" : "[HTTPS listeners] Information about an identity provider that is compliant with OpenID Connect (OIDC). Specify only when ``Type`` is ``authenticate-oidc``."
        },
        "JwtValidationConfig" : {
          "$ref" : "#/definitions/JwtValidationConfig",
          "description" : "[HTTPS listeners] Information for validating JWT access tokens in client requests. Specify only when ``Type`` is ``jwt-validation``."
        }
      },
      "required" : [ "Type" ],
      "description" : "Specifies an action for a listener rule."
    },
    "RuleCondition" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Field" : {
          "type" : "string",
          "description" : "The field in the HTTP request. The following are the possible values:\n  +   ``http-header`` \n  +   ``http-request-method`` \n  +   ``host-header`` \n  +   ``path-pattern`` \n  +   ``query-string`` \n  +   ``source-ip``"
        },
        "RegexValues" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The regular expressions to match against the condition field. The maximum length of each string is 128 characters. Specify only when ``Field`` is ``http-header``, ``host-header``, or ``path-pattern``."
        },
        "Values" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The condition value. Specify only when ``Field`` is ``host-header`` or ``path-pattern``. Alternatively, to specify multiple host names or multiple path patterns, use ``HostHeaderConfig`` or ``PathPatternConfig``.\n If ``Field`` is ``host-header`` and you're not using ``HostHeaderConfig``, you can specify a single host name (for example, my.example.com). A host name is case insensitive, can be up to 128 characters in length, and can contain any of the following characters.\n  +  A-Z, a-z, 0-9\n  +  - .\n  +  * (matches 0 or more characters)\n  +  ? (matches exactly 1 character)\n  \n If ``Field`` is ``path-pattern`` and you're not using ``PathPatternConfig``, you can specify a single path pattern (for example, /img/*). A path pattern is case-sensitive, can be up to 128 characters in length, and can contain any of the following characters.\n  +  A-Z, a-z, 0-9\n  +  _ - . $ / ~ \" ' @ : +\n  +  & (using &amp;)\n  +  * (matches 0 or more characters)\n  +  ? (matches exactly 1 character)"
        },
        "HttpRequestMethodConfig" : {
          "$ref" : "#/definitions/HttpRequestMethodConfig",
          "description" : "Information for an HTTP method condition. Specify only when ``Field`` is ``http-request-method``."
        },
        "PathPatternConfig" : {
          "$ref" : "#/definitions/PathPatternConfig",
          "description" : "Information for a path pattern condition. Specify only when ``Field`` is ``path-pattern``."
        },
        "HttpHeaderConfig" : {
          "$ref" : "#/definitions/HttpHeaderConfig",
          "description" : "Information for an HTTP header condition. Specify only when ``Field`` is ``http-header``."
        },
        "SourceIpConfig" : {
          "$ref" : "#/definitions/SourceIpConfig",
          "description" : "Information for a source IP condition. Specify only when ``Field`` is ``source-ip``."
        },
        "HostHeaderConfig" : {
          "$ref" : "#/definitions/HostHeaderConfig",
          "description" : "Information for a host header condition. Specify only when ``Field`` is ``host-header``."
        },
        "QueryStringConfig" : {
          "$ref" : "#/definitions/QueryStringConfig",
          "description" : "Information for a query string condition. Specify only when ``Field`` is ``query-string``."
        }
      },
      "description" : "Specifies a condition for a listener rule."
    },
    "QueryStringConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Values" : {
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/QueryStringKeyValue"
          },
          "description" : "The key/value pairs or values to find in the query string. The maximum length of each string is 128 characters. The comparison is case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). To search for a literal '*' or '?' character in a query string, you must escape these characters in ``Values`` using a '\\' character.\n If you specify multiple key/value pairs or values, the condition is satisfied if one of them is found in the query string."
        }
      },
      "description" : "Information about a query string condition.\n The query string component of a URI starts after the first '?' character and is terminated by either a '#' character or the end of the URI. A typical query string contains key/value pairs separated by '&' characters. The allowed characters are specified by RFC 3986. Any character can be percentage encoded."
    },
    "TargetGroupStickinessConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "type" : "boolean",
          "description" : "Indicates whether target group stickiness is enabled."
        },
        "DurationSeconds" : {
          "type" : "integer",
          "description" : "[Application Load Balancers] The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days). You must specify this value when enabling target group stickiness."
        }
      },
      "description" : "Information about the target group stickiness for a rule."
    },
    "PathPatternConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "RegexValues" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : ""
        },
        "Values" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The path patterns to compare against the request URL. The maximum size of each string is 128 characters. The comparison is case sensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character).\n If you specify multiple strings, the condition is satisfied if one of them matches the request URL. The path pattern is compared only to the path of the URL, not to its query string."
        }
      },
      "description" : "Information about a path pattern condition."
    },
    "FixedResponseConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ContentType" : {
          "type" : "string",
          "description" : "The content type.\n Valid Values: text/plain | text/css | text/html | application/javascript | application/json"
        },
        "StatusCode" : {
          "type" : "string",
          "description" : "The HTTP response code (2XX, 4XX, or 5XX)."
        },
        "MessageBody" : {
          "type" : "string",
          "description" : "The message."
        }
      },
      "required" : [ "StatusCode" ],
      "description" : "Specifies information required when returning a custom HTTP response."
    },
    "HttpHeaderConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "RegexValues" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : ""
        },
        "Values" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The strings to compare against the value of the HTTP header. The maximum length of each string is 128 characters. The comparison strings are case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character).\n If the same header appears multiple times in the request, we search them in order until a match is found.\n If you specify multiple strings, the condition is satisfied if one of the strings matches the value of the HTTP header. To require that all of the strings are a match, create one condition per string."
        },
        "HttpHeaderName" : {
          "type" : "string",
          "description" : "The name of the HTTP header field. The maximum size is 40 characters. The header name is case insensitive. The allowed characters are specified by RFC 7230. Wildcards are not supported."
        }
      },
      "description" : "Information about an HTTP header condition.\n There is a set of standard HTTP header fields. You can also define custom HTTP header fields."
    },
    "AuthenticateCognitoConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "OnUnauthenticatedRequest" : {
          "type" : "string",
          "description" : "The behavior if the user is not authenticated. The following are possible values:\n  +  deny```` - Return an HTTP 401 Unauthorized error.\n  +  allow```` - Allow the request to be forwarded to the target.\n  +  authenticate```` - Redirect the request to the IdP authorization endpoint. This is the default value."
        },
        "UserPoolClientId" : {
          "type" : "string",
          "description" : "The ID of the Amazon Cognito user pool client."
        },
        "UserPoolDomain" : {
          "type" : "string",
          "description" : "The domain prefix or fully-qualified domain name of the Amazon Cognito user pool."
        },
        "SessionTimeout" : {
          "type" : "integer",
          "description" : "The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days)."
        },
        "Scope" : {
          "type" : "string",
          "description" : "The set of user claims to be requested from the IdP. The default is ``openid``.\n To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP."
        },
        "SessionCookieName" : {
          "type" : "string",
          "description" : "The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie."
        },
        "UserPoolArn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of the Amazon Cognito user pool."
        },
        "AuthenticationRequestExtraParams" : {
          "type" : "object",
          "additionalProperties" : false,
          "patternProperties" : {
            "[a-zA-Z0-9]+" : {
              "type" : "string"
            }
          },
          "description" : "The query parameters (up to 10) to include in the redirect request to the authorization endpoint."
        }
      },
      "required" : [ "UserPoolClientId", "UserPoolDomain", "UserPoolArn" ],
      "description" : "Specifies information required when integrating with Amazon Cognito to authenticate users."
    },
    "RedirectConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Path" : {
          "type" : "string",
          "description" : "The absolute path, starting with the leading \"/\". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}."
        },
        "Query" : {
          "type" : "string",
          "description" : "The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading \"?\", as it is automatically added. You can specify any of the reserved keywords."
        },
        "Port" : {
          "type" : "string",
          "description" : "The port. You can specify a value from 1 to 65535 or #{port}."
        },
        "Host" : {
          "type" : "string",
          "description" : "The hostname. This component is not percent-encoded. The hostname can contain #{host}."
        },
        "Protocol" : {
          "type" : "string",
          "description" : "The protocol. You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You can't redirect HTTPS to HTTP."
        },
        "StatusCode" : {
          "type" : "string",
          "description" : "The HTTP redirect code. The redirect is either permanent (HTTP 301) or temporary (HTTP 302)."
        }
      },
      "required" : [ "StatusCode" ],
      "description" : "Information about a redirect action.\n A URI consists of the following components: protocol://hostname:port/path?query. You must modify at least one of the following components to avoid a redirect loop: protocol, hostname, port, or path. Any components that you do not modify retain their original values.\n You can reuse URI components using the following reserved keywords:\n  +  #{protocol}\n  +  #{host}\n  +  #{port}\n  +  #{path} (the leading \"/\" is removed)\n  +  #{query}\n  \n For example, you can change the path to \"/new/#{path}\", the hostname to \"example.#{host}\", or the query to \"#{query}&value=xyz\"."
    },
    "QueryStringKeyValue" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Value" : {
          "type" : "string",
          "description" : "The value."
        },
        "Key" : {
          "type" : "string",
          "description" : "The key. You can omit the key."
        }
      },
      "description" : "Information about a key/value pair."
    },
    "ForwardConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "TargetGroupStickinessConfig" : {
          "$ref" : "#/definitions/TargetGroupStickinessConfig",
          "description" : "Information about the target group stickiness for a rule."
        },
        "TargetGroups" : {
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/TargetGroupTuple"
          },
          "description" : "Information about how traffic will be distributed between multiple target groups in a forward rule."
        }
      },
      "description" : "Information for creating an action that distributes requests among multiple target groups. Specify only when ``Type`` is ``forward``.\n If you specify both ``ForwardConfig`` and ``TargetGroupArn``, you can specify only one target group using ``ForwardConfig`` and it must be the same target group specified in ``TargetGroupArn``."
    },
    "HostHeaderConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "RegexValues" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : ""
        },
        "Values" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The host names. The maximum length of each string is 128 characters. The comparison is case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). You must include at least one \".\" character. You can include only alphabetical characters after the final \".\" character.\n If you specify multiple strings, the condition is satisfied if one of the strings matches the host name."
        }
      },
      "description" : "Information about a host header condition."
    },
    "HttpRequestMethodConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Values" : {
          "$ref" : "#/definitions/ListOfStrings",
          "description" : "The name of the request method. The maximum length is 40 characters. The allowed characters are A-Z, hyphen (-), and underscore (_). The comparison is case sensitive. Wildcards are not supported; therefore, the method name must be an exact match.\n If you specify multiple strings, the condition is satisfied if one of the strings matches the HTTP request method. We recommend that you route GET and HEAD requests in the same way, because the response to a HEAD request may be cached."
        }
      },
      "description" : "Information about an HTTP method condition.\n HTTP defines a set of request methods, also referred to as HTTP verbs. For more information, see the [HTTP Method Registry](https://docs.aws.amazon.com/https://www.iana.org/assignments/http-methods/http-methods.xhtml). You can also define custom HTTP methods."
    },
    "AuthenticateOidcConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "OnUnauthenticatedRequest" : {
          "type" : "string",
          "description" : "The behavior if the user is not authenticated. The following are possible values:\n  +  deny```` - Return an HTTP 401 Unauthorized error.\n  +  allow```` - Allow the request to be forwarded to the target.\n  +  authenticate```` - Redirect the request to the IdP authorization endpoint. This is the default value."
        },
        "TokenEndpoint" : {
          "type" : "string",
          "description" : "The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path."
        },
        "SessionTimeout" : {
          "type" : "integer",
          "description" : "The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days)."
        },
        "Scope" : {
          "type" : "string",
          "description" : "The set of user claims to be requested from the IdP. The default is ``openid``.\n To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP."
        },
        "Issuer" : {
          "type" : "string",
          "description" : "The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path."
        },
        "ClientSecret" : {
          "type" : "string",
          "description" : "The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set ``UseExistingClientSecret`` to true."
        },
        "UserInfoEndpoint" : {
          "type" : "string",
          "description" : "The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path."
        },
        "ClientId" : {
          "type" : "string",
          "description" : "The OAuth 2.0 client identifier."
        },
        "AuthorizationEndpoint" : {
          "type" : "string",
          "description" : "The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path."
        },
        "SessionCookieName" : {
          "type" : "string",
          "description" : "The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie."
        },
        "UseExistingClientSecret" : {
          "type" : "boolean",
          "description" : "Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false."
        },
        "AuthenticationRequestExtraParams" : {
          "type" : "object",
          "additionalProperties" : false,
          "patternProperties" : {
            "[a-zA-Z0-9]+" : {
              "type" : "string"
            }
          },
          "description" : "The query parameters (up to 10) to include in the redirect request to the authorization endpoint."
        }
      },
      "required" : [ "TokenEndpoint", "Issuer", "UserInfoEndpoint", "ClientId", "AuthorizationEndpoint" ],
      "anyOf" : [ {
        "required" : [ "ClientSecret" ]
      }, {
        "required" : [ "UseExistingClientSecret" ]
      } ],
      "description" : "Specifies information required using an identity provide (IdP) that is compliant with OpenID Connect (OIDC) to authenticate users."
    },
    "JwtValidationConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "JwksEndpoint" : {
          "type" : "string",
          "description" : ""
        },
        "Issuer" : {
          "type" : "string",
          "description" : ""
        },
        "AdditionalClaims" : {
          "type" : "array",
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/JwtValidationActionAdditionalClaim"
          },
          "description" : ""
        }
      },
      "required" : [ "JwksEndpoint", "Issuer" ],
      "description" : ""
    },
    "JwtValidationActionAdditionalClaim" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Format" : {
          "type" : "string",
          "description" : "The format of the claim value."
        },
        "Name" : {
          "type" : "string",
          "description" : "The name of the claim. You can't specify ``exp``, ``iss``, ``nbf``, or ``iat`` because we validate them by default."
        },
        "Values" : {
          "type" : "array",
          "uniqueItems" : true,
          "items" : {
            "type" : "string"
          },
          "description" : "The claim value. The maximum size of the list is 10. Each value can be up to 256 characters in length. If the format is ``space-separated-values``, the values can't include spaces."
        }
      },
      "required" : [ "Format", "Name", "Values" ],
      "description" : "Information about an additional claim to validate."
    },
    "SourceIpConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Values" : {
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          },
          "description" : "The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported.\n If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header."
        }
      },
      "description" : "Information about a source IP condition.\n You can use this condition to route based on the IP address of the source that connects to the load balancer. If a client is behind a proxy, this is the IP address of the proxy not the IP address of the client."
    },
    "Transform" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "type" : "string",
          "description" : ""
        },
        "HostHeaderRewriteConfig" : {
          "$ref" : "#/definitions/RewriteConfigObject",
          "description" : ""
        },
        "UrlRewriteConfig" : {
          "$ref" : "#/definitions/RewriteConfigObject",
          "description" : ""
        }
      },
      "required" : [ "Type" ],
      "oneOf" : [ {
        "required" : [ "HostHeaderRewriteConfig" ]
      }, {
        "required" : [ "UrlRewriteConfig" ]
      } ],
      "description" : ""
    },
    "RewriteConfigObject" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Rewrites" : {
          "$ref" : "#/definitions/RewriteConfigList",
          "description" : ""
        }
      },
      "required" : [ "Rewrites" ],
      "description" : ""
    },
    "RewriteConfigList" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/RewriteConfig"
      }
    },
    "RewriteConfig" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Regex" : {
          "type" : "string",
          "description" : "The regular expression to match in the input string. The maximum length of the string is 1,024 characters."
        },
        "Replace" : {
          "type" : "string",
          "description" : "The replacement string to use when rewriting the matched input. The maximum length of the string is 1,024 characters. You can specify capture groups in the regular expression (for example, $1 and $2)."
        }
      },
      "required" : [ "Regex", "Replace" ],
      "description" : "Information about a rewrite transform. This transform matches a pattern and replaces it with the specified string."
    },
    "ListOfStrings" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "type" : "string"
      }
    }
  },
  "required" : [ "Actions", "Priority", "Conditions" ],
  "createOnlyProperties" : [ "/properties/ListenerArn" ],
  "primaryIdentifier" : [ "/properties/RuleArn" ],
  "readOnlyProperties" : [ "/properties/RuleArn", "/properties/IsDefault" ],
  "writeOnlyProperties" : [ "/properties/Actions/*/AuthenticateOidcConfig/ClientSecret", "/properties/ListenerArn" ],
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "elasticloadbalancing:CreateRule", "elasticloadbalancing:DescribeRules", "cognito-idp:DescribeUserPoolClient" ]
    },
    "delete" : {
      "permissions" : [ "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DescribeRules" ]
    },
    "list" : {
      "handlerSchema" : {
        "properties" : {
          "ListenerArn" : {
            "$ref" : "resource-schema.json#/properties/ListenerArn"
          },
          "RuleArns" : {
            "type" : "array",
            "uniqueItems" : false,
            "insertionOrder" : false,
            "items" : {
              "$ref" : "resource-schema.json#/properties/RuleArn"
            }
          }
        },
        "oneOf" : [ {
          "required" : [ "ListenerArn" ]
        }, {
          "required" : [ "RuleArns" ]
        } ]
      },
      "permissions" : [ "elasticloadbalancing:DescribeRules" ]
    },
    "read" : {
      "permissions" : [ "elasticloadbalancing:DescribeRules" ]
    },
    "update" : {
      "permissions" : [ "elasticloadbalancing:ModifyRule", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:DescribeRules" ]
    }
  }
}