[
  {
    "Name": "php2shell-upload-progress-count",
    "Priority": 0,
    "Action": { "Count": {} },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "php2shell-upload-progress-count"
    },
    "Statement": {
      "AndStatement": {
        "Statements": [
          {
            "ByteMatchStatement": {
              "FieldToMatch": { "Method": {} },
              "PositionalConstraint": "EXACTLY",
              "SearchString": "POST",
              "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
            }
          },
          {
            "OrStatement": {
              "Statements": [
                {
                  "ByteMatchStatement": {
                    "FieldToMatch": {
                      "Cookies": {
                        "MatchPattern": { "All": {} },
                        "MatchScope": "KEY",
                        "OversizeHandling": "CONTINUE"
                      }
                    },
                    "PositionalConstraint": "EXACTLY",
                    "SearchString": "PHPSESSID",
                    "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
                  }
                },
                {
                  "ByteMatchStatement": {
                    "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } },
                    "PositionalConstraint": "CONTAINS",
                    "SearchString": "PHPSESSID",
                    "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
                  }
                }
              ]
            }
          },
          {
            "ByteMatchStatement": {
              "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } },
              "PositionalConstraint": "CONTAINS",
              "SearchString": "PHP_SESSION_UPLOAD_PROGRESS",
              "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
            }
          }
        ]
      }
    }
  },
  {
    "Name": "php2shell-oversize-body-count",
    "Priority": 1,
    "Action": { "Count": {} },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "php2shell-oversize-body-count"
    },
    "Statement": {
      "SizeConstraintStatement": {
        "FieldToMatch": { "Body": { "OversizeHandling": "MATCH" } },
        "ComparisonOperator": "GT",
        "Size": 8192,
        "TextTransformations": [{ "Priority": 0, "Type": "NONE" }]
      }
    }
  }
]