Action overrides in rule groups - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced

Action overrides in rule groups

When you add a rule group to your web ACL, you can override the actions it takes on matching web requests. Overriding the actions for a rule group inside your web ACL configuration doesn't alter the rule group itself. It only alters how AWS WAF uses the rule group in the context of the web ACL.

Rule action overrides

You can override the actions of the rules inside a rule group to any valid rule action. For a list of actions, see AWS WAF rule action. When you do this, matching requests are handled exactly as if the configured rule's action were the override setting.

For information about how to use this option, see Overriding rule actions in a rule group.

Overriding the rule action to Count

The most common use case for rule action overrides is overriding some or all of the rule actions to Count, in order to test and monitor a rule group's behavior before putting it into production.

You can also use this to troubleshoot a rule group that's generating false positives. False positives occur when a rule group blocks traffic that you aren't expecting it to block. If you identify a rule within a rule group that would block requests that you want to allow through, you can keep the count action override on that rule, to exclude it from acting on your requests.

For more information about using the rule action override in testing, see Testing and tuning your AWS WAF protections.

JSON listing: RuleActionOverrides replaces ExcludedRules

If you set rule group rule actions to Count in your web ACL configuration prior to October 27, 2022, AWS WAF saved your overrides in the web ACL JSON as ExcludedRules. Now, the JSON setting for overriding a rule to Count is in the RuleActionOverrides settings.

When you use the AWS WAF console to edit the existing rule group settings, the console automatically converts any ExcludedRules settings in the JSON to RuleActionOverrides settings, with the override action set to Count.

  • Current setting example:

    "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesAdminProtectionRuleSet", "RuleActionOverrides": [ { "Name": "AdminProtection_URIPATH", "ActionToUse": { "Count": {} } } ]
  • Old setting example:

    OLD SETTING "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesAdminProtectionRuleSet", "ExcludedRules": [ { "Name": "AdminProtection_URIPATH" } ] OLD SETTING

We recommend that you update all of your ExcludedRules settings in your JSON listings to RuleActionOverrides settings with the action set to Count. The API accepts either setting, but you'll get consistency in your JSON listings, between your console work and your API work, if you only use the new RuleActionOverrides setting.

Rule group action override to Count

You can override the action that the rule group returns, setting it to Count.

Note

This is not a good option for testing the rules in a rule group, because it doesn't alter how AWS WAF evaluates the rule group itself. It only affects how AWS WAF handles results that are returned to the web ACL from the rule group evaluation. If you want to test the rules in a rule group, use the option described in the preceding section, Rule action overrides.

When you override the rule group action to Count, AWS WAF processes the rule group evaluation normally.

If no rules in the rule group match or if all matching rules have a Count action, then this override has no effect on the processing of the rule group or the web ACL.

The first rule in the rule group that matches a web request and that has a terminating rule action causes AWS WAF to stop evaluating the rule group and return the terminating action result to the web ACL evaluation level. At this point, in the web ACL evaluation, this override takes effect. AWS WAF overrides the terminating action so that the result of the rule group evaluation is only a Count action. AWS WAF then continues processing the rest of the rules in the web ACL.

For information about how to use this option, see Overriding a rule group's evaluation result to Count.