How do I allow requests from an oversized request body to pass through WAF?

Question

Hello，
In the EC2 instance, there is an image processing API, and I associate a WAF on ALB, then configured the following rule in the WAF:  
```typescript
const awsManagedRulesCommonRuleSet: wafv2.CfnWebACL.RuleProperty = {
  name: `AWS-AWSManagedRulesCommonRuleSet`,
  priority: 0,
  overrideAction: { none: {} },
  visibilityConfig: {
    metricName: `MetricForAMRCRS`,
    sampledRequestsEnabled: true,
    cloudWatchMetricsEnabled: true,
  },
  statement: {
    managedRuleGroupStatement: {
      vendorName: 'AWS',
      name: 'AWSManagedRulesCommonRuleSet',
      excludedRules: [
        { 
          name: 'SizeRestrictions_BODY',
        },
        {
          name: 'NoUserAgent_HEADER',
        },
      ],
    },
  },
};
new wafv2.CfnWebACL(this, 'ServerWebACLs', {
  name: 'ServerALB-WebACLs',
  scope: 'REGIONAL',
  defaultAction: { allow: {} },
  visibilityConfig: {
    metricName: 'ServerALB-WebACLs',
    sampledRequestsEnabled: true,
    cloudWatchMetricsEnabled: true,
  },
  rules: [
    awsManagedRulesCommonRuleSet,
    // and some other rule,such as IPRule,SqlRule...
  ],
});
```
The request body of the API contains image data,  when I call that API through Cloudfront, I keep getting a 403 error.
If I use an API that doesn't contain image data, it can be called successfully.
Why is that? Am I not configured correctly?

Answer

You've included the `awsManagedRulesCommonRuleSet` - looking at [the documentation](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html) it includes a rule that is defined as follows:

```
SizeRestrictions_BODY 	
Inspects for request bodies that are over 8 KB (8,192 bytes).
Rule action: Block
```

So perhaps don't use that rule set?

Answer

Hi,

It could be useful to configure [AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/logging-cw-logs.html) for sending web ACL traffic logs to CloudWatch and identify the rules that the request matched.

How do I allow requests from an oversized request body to pass through WAF?

Contenuto pertinente