How can I troubleshoot false positives with AWS WAF?
Last updated: 2019-12-06
AWS WAF is blocking some of my legitimate web requests. How can I find out why WAF is blocking traffic and resolve these false positives?
To troubleshoot false positives in AWS WAF:
- Identify the rules that are causing false positives
- Reconfigure the rules to enable traffic and prevent false positives
Identify the rules that are causing false positives
- Open the WAF console and choose Go to AWS WAF.
- Choose Web ACLs from the navigation pane.
- Select the name of the Web ACL that you're testing.
- For Sample requests, select the first rule in the list, and then choose Get new samples. Review the results to find any blocked requests.
Note: AWS WAF randomly selects requests from the first 5,000 requests that your AWS resource received during the specified time range. You can specify a sample size of up to 500 requests, and any time range in the previous three hours.
- Repeat step 4 for each of the remaining rules in your Web ACL.
Note: It's a best practice to use AWS WAF Logging to find the rule ID that triggered the block for your specific HTTP request.
Reconfigure the rules to enable traffic and prevent false positives
- Complete the following for each rule that you identified as containing blocked requests:
Choose the Rules tab.
Choose Edit web ACL.
Change the Action from Block to Count.
- After you've made all necessary changes to the rules, choose Update.
- Resend requests to the updated rules to confirm that they're no longer blocked. To do this, select each updated rule from the Sample requests dropdown, and then choose Get new samples.
- Review each updated rule and compare the sample requests with the conditions of the rule. Remove any conditions that are blocking legitimate requests based on the filters in the condition.