Waste of time if you want to know why particular traffic is blocked
Why did that particular IP address get blocked?
This is a question I get asked regularly by management. My usual route to the answer is checking for source ip addresses on abuse lists and then reporting on those.
For the rest of the traffic that gets blocked, I can't correlate the rule id that shows up in a log file with a rule name that's understandable by a human.
Yes, humans do still exist and some of them pay our salaries, so we need to let them know what's blocking (in some cases) legitimate traffic to their websites.
In my view, this is the case across the board when using the AWS WAF solution with managed rule groups. This service is not market ready.
It's all well and good saying there's a shared responsibility model but I've yet to find someone with an easy way to work out what rule blocked their traffic.
Not even F5 support or an AWS support person could tell me how to do this.