Can AWS WAF enforce request body size limits beyond its inspection threshold?

In short: Yes, your understanding is correct.

AWS WAF cannot natively and reliably enforce an arbitrary request body size limit (such as 1 MB) because of the architectural constraints regarding how underlying services forward data to WAF.

A technical breakdown of why this cannot be securely handled at the WAF layer, and why it must be enforced at your target application:

1. The 8 KB Inspection Limit

When AWS WAF is attached to an Application Load Balancer (ALB), the ALB forwards a maximum of exactly 8 KB (8,192 bytes) of the request body to WAF for inspection.

(Reference: Handling oversize web request components - See the "Hard limits" table).

Because WAF never receives the payload beyond those initial 8 KB, it cannot quantify the total size. The OversizeHandling configuration only knows that the body exceeds 8 KB; it cannot differentiate between a 10 KB payload and a 50 MB payload. Therefore, a WAF SizeConstraintStatement targeting the body simply cannot evaluate limits higher than the 8 KB threshold.

2. The Content-Length Bypass (Why checking headers fails)

A common, but flawed, workaround is attempting to create a WAF rule that inspects the HTTP Content-Length header and blocks requests where the value is greater than 1048576 (1 MB).

This is not a watertight security control. A client (or attacker) can bypass this WAF rule entirely by sending the payload using Transfer-Encoding: chunked. In a chunked request, the Content-Length header is omitted, but the ALB still natively supports chunked encoding and will forward the massive payload to your backend. Because the WAF rule relies on a header that isn't there, the request is allowed through.

3. The Core Rule Set (CRS) Strategy

Your proposed approach—using the managed SizeRestrictions_BODY rule to drop requests > 8 KB globally, and explicitly allowing oversized requests on known endpoints (like /upload)—is the standard AWS best practice to reduce your attack surface.

(Reference: AWS Managed Rules baseline rule groups - Core rule set).

However, as you correctly noted, any endpoint you whitelist effectively bypasses size inspection at the WAF level.

How to actually enforce the 1 MB limit

Because WAF is architecturally blind to total payload sizes exceeding 8 KB on an ALB, this limit must be enforced by the target application or the reverse proxy hosting it.

Allow the oversized requests through WAF for your legitimate upload paths, and configure your web server/framework to reject excessive payloads with an HTTP 413 (Payload Too Large) response.

Standard implementation examples depending on your stack:

• NGINX: client_max_body_size 1m;
• Apache: LimitRequestBody 1048576
• Node/Express: express.json({ limit: '1mb' })
• Spring Boot: spring.servlet.multipart.max-request-size=1MB

Yes, AWS WAF cannot natively block requests above an arbitrary size like 1 MB. It only enforces inspection thresholds (8 KB–64 KB). For larger payload enforcement, you must implement checks at the application layer or use header-based filtering outside WAF.

https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html

https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html