AWS WAF: Overriding Rule Actions in a Rule Group – Source: socprime.com

Steps to Override Rule Actions

1. Access the Web ACL:

• Navigate to the Rules tab of the web ACL page.
• Select the rule group and click Edit.

2. Manage Rule Actions:

All Rules:

• Open the Override all rule actions dropdown.
• Select the desired override action or choose Remove all overrides to clear them.

Single Rule:

• Open the dropdown for the specific rule.
• Select the override action or choose Remove override to clear it.

3. Save Changes

• Click Save rule to apply your changes.
• The updated rule actions and override settings are displayed on the rule group page.

Here is the example of the JSON configuration or overriding rule actions:

{     "Name": "AWS-AWSBotControl",    "Priority": 7,     "Statement": {     "ManagedRuleGroupStatement": {         "VendorName": "AWS",         "Name": "AWSManagedRulesBotControlRuleSet",         "RuleActionOverrides": [           {             "ActionToUse": {               "Count": {}             },             "Name": "CategoryVerifiedSearchEngine"           },           {             "ActionToUse": {               "Count": {}             },             "Name": "CategoryVerifiedSocialMedia"           }         ],         "ExcludedRules": []     },    "VisibilityConfig": {        "SampledRequestsEnabled": true,        "CloudWatchMetricsEnabled": true,        "MetricName": "AWS-AWSBotControl"    } }

Was this article helpful?

Like and share it with your peers.