How do I detect false positives caused by AWS Managed Rules?

Resolution

First, identify the false positives caused by AWS Managed Rules. Then, use labels or a scope-down statement to add those false positives to your allow list.

Note: The following example uses IP sets. However, you can use any attribute that AWS WAF can inspect in your custom rules with labels including headers and URIs.

Detect false positive errors from managed rule groups

Complete the following steps:

1. In your AWS WAF logs, under terminatingRuleId, find the managed rule group that blocks the legitimate request. The following is an example of an AWS WAF log:

   {
     "timestamp": 1712236911743,
     "formatVersion": 1,
     "webaclId": "arn:aws:wafv2:us-west-2:***:regional/webacl/WAFtester/3c372***-***",
     "terminatingRuleId": "AWS-AWSManagedRulesCommonRuleSet",
     "terminatingRuleType": "MANAGED_RULE_GROUP",
     "action": "BLOCK",
     "terminatingRuleMatchDetails": [],
     "ruleGroupList": [
       {
         "ruleGroupId": "AWS#AWSManagedRulesCommonRuleSet",
         "terminatingRule": {
           "ruleId": "SizeRestrictions_BODY",
           "action": "BLOCK",
           "overriddenAction": "BLOCK",
           "ruleMatchDetails": null
         },
         "nonTerminatingMatchingRules": [],
         "excludedRules": null,
         "customerConfig": null
       }
     ]
   }

2. In terminatingRule, find ruleId to identify the rule that blocks the legitimate request. For example, in the preceding log, the rule that blocks the legitimate request is SizeRestrictions_Body.

3. Identify the attribute or criteria that causes the false positive. For example, if a database admin runs stored procedures remotely, then their requests might contain a large volume of data. The ManagedRulesCommonRuleSet rule group blocks these requests because of the SizeRestrictions_Body rule.

Add false positives to your allow list

To allow the legitimate requests through the managed rule group that causes the false positive, configure the web access control list (web ACL). First create an IP set, then use either labels or scope-down statements.

Note: It's a best practice to use labels for fine-grain explicit rules. The scope-down statement doesn't inspect requests that fall out of scope against all rules in a rule group.

Labels

Use labels added by AWS Managed Rules to prevent false positives. When you create custom rules that match requests with these labels, change the default action of the rules inside the managed rule group.

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, choose Protection packs (web ACLs).
3. Select your protection pack and then choose Manage rules.
4. Choose the AWS Managed Rules that blocks your requests.
   Note: Identify the rule that blocks your request from your log.
5. Under Rule overrides, for the rule that blocks the request, change the action to Count.
6. Choose Save rule.
7. In the right pane, choose Manage rule, and then choose Add rule.
8. Select Custom rule and then choose Next.
9. For rule type, select Custom rule and then choose Next.
10. For Action select BLOCK.
11. Enter your Rule name.
12. For If a request, select matches all the statements (AND).
13. In Statement 1, use the following options:
    For Inspect, choose Has a label.
    For Statement, choose Label.
    For Match key, select the label for the AWS Managed Rules rule group's rule that blocks your requests.
14. In Statement 2, use the following options:
    For Inspect, choose Originates from IP address in.
    For IP address list, select your IP set.
    In Rule configuration, select Negate statement (NOT).
    For Source IP address for origin, select Source IP address.
15. Choose Add rule.
16. Choose Edit Rule Order and then drag the new rule below the AWS Managed Rule Group.
    Note: Rules are applied in the order they appear and your new rule must be below the AWS Managed Rule Group.
17. Choose Save Rule Order.

Scope-down statement

Use a scope-down statement to narrow the scope of the requests that the rule or rule group evaluates. When you add a scope-down statement to a rule group, the requests is inspected. The statement skips legitimate IP addresses that are included in the statement.

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select your protection pack and choose Manage rule.
4. Choose the AWS Managed Rules rule group that blocks your requests.
5. In Inspection, select Match statement and then use the following options:
   For If a request, select doesn't match the statement (NOT).
   For Inspect, select Originates from IP address in.
   For IP address list, select your IP set.
   In Rule configuration, for Source IP address for origin, select Source IP address as origin.
6. Choose Save rule.