Baseline rule groups
Baseline managed rule groups provide general protection against a wide variety of common threats. Choose one or more of these rule groups to establish baseline protection for your resources.
Note
The information that we publish for the rules in the AWS Managed Rules rule groups is intended to provide you
with enough information to use the rules while not providing information that
bad actors could use to circumvent the rules. If you need more information than
you find in this documentation, contact the AWS Support Center
Core rule set (CRS) managed rule group
VendorName: AWS
, Name:
AWSManagedRulesCommonRuleSet
, WCU: 700
The core rule set (CRS) rule group contains rules that are generally applicable to web
applications. This provides protection against exploitation of a wide range
of vulnerabilities, including some of the high risk and commonly occurring
vulnerabilities described in OWASP publications such as OWASP Top 10
This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Using labels on web requests and Label metrics and dimensions.
Note
This table describes the latest static version of this rule group. For other versions, use the API command DescribeManagedRuleGroup.
Rule name | Description and label |
---|---|
NoUserAgent_HEADER |
Inspects for requests that are missing the HTTP
Rule action: Block Label:
|
UserAgent_BadBots_HEADER |
Inspects for common Rule action: Block Label:
|
SizeRestrictions_QUERYSTRING |
Inspects for URI query strings that are over 2,048 bytes. Rule action: Block Label:
|
SizeRestrictions_Cookie_HEADER |
Inspects for cookie headers that are over 10,240 bytes. Rule action: Block Label:
|
SizeRestrictions_BODY |
Inspects for request bodies that are over 8 KB (8,192 bytes). Rule action: Block Label:
|
SizeRestrictions_URIPATH |
Inspects for URI paths that are over 1,024 bytes. Rule action: Block Label:
|
EC2MetaDataSSRF_BODY |
Inspects for attempts to exfiltrate Amazon EC2 metadata from the request body. WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
EC2MetaDataSSRF_COOKIE |
Inspects for attempts to exfiltrate Amazon EC2 metadata from the request cookie. Rule action: Block Label:
|
EC2MetaDataSSRF_URIPATH |
Inspects for attempts to exfiltrate Amazon EC2 metadata from the request URI path. Rule action: Block Label:
|
EC2MetaDataSSRF_QUERYARGUMENTS |
Inspects for attempts to exfiltrate Amazon EC2 metadata from the request query arguments. Rule action: Block Label:
|
GenericLFI_QUERYARGUMENTS |
Inspects for the presence of Local File Inclusion
(LFI) exploits in the query arguments. Examples
include path traversal attempts using techniques
like Rule action: Block Label:
|
GenericLFI_URIPATH |
Inspects for the presence of Local File Inclusion
(LFI) exploits in the URI path. Examples include
path traversal attempts using techniques like
Rule action: Block Label:
|
GenericLFI_BODY |
Inspects for the presence of Local File Inclusion
(LFI) exploits in the request body. Examples include
path traversal attempts using techniques like
WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
RestrictedExtensions_URIPATH |
Inspects for requests whose URI paths contain system file extensions that are
unsafe to read or run. Example patterns include
extensions like Rule action: Block Label:
|
RestrictedExtensions_QUERYARGUMENTS |
Inspects for requests whose query arguments contain system file extensions that are
unsafe to read or run. Example patterns include
extensions like Rule action: Block Label:
|
GenericRFI_QUERYARGUMENTS |
Inspects the values of all query parameters for
attempts to exploit RFI (Remote File Inclusion) in
web applications by embedding URLs that contain IPv4
addresses. Examples include patterns like
Rule action: Block Label:
|
GenericRFI_BODY |
Inspects the request body for attempts to exploit
RFI (Remote File Inclusion) in web applications by
embedding URLs that contain IPv4 addresses. Examples
include patterns like WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
GenericRFI_URIPATH |
Inspects the URI path for attempts to exploit RFI
(Remote File Inclusion) in web applications by
embedding URLs that contain IPv4 addresses. Examples
include patterns like Rule action: Block Label:
|
CrossSiteScripting_COOKIE |
Inspects the values of cookie headers for common cross-site scripting (XSS)
patterns using the built-in AWS WAF Cross-site scripting attack
rule statement.
Example patterns include scripts like
NoteThe rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group. Rule action: Block Label:
|
CrossSiteScripting_QUERYARGUMENTS |
Inspects the values of query arguments for common
cross-site scripting (XSS) patterns using the
built-in AWS WAF Cross-site scripting attack
rule statement. Example
patterns include scripts like
NoteThe rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group. Rule action: Block Label:
|
CrossSiteScripting_BODY |
Inspects the request body for common cross-site
scripting (XSS) patterns using the built-in AWS WAF Cross-site scripting attack
rule statement. Example patterns include
scripts like
NoteThe rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group. WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
CrossSiteScripting_URIPATH |
Inspects the value of the URI path for common
cross-site scripting (XSS) patterns using the
built-in AWS WAF Cross-site scripting attack
rule statement. Example
patterns include scripts like
NoteThe rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group. Rule action: Block Label:
|
Admin protection managed rule group
VendorName: AWS
, Name:
AWSManagedRulesAdminProtectionRuleSet
, WCU:
100
The Admin protection rule group contains rules that allow you to block external access to exposed administrative pages. This might be useful if you run third-party software or want to reduce the risk of a malicious actor gaining administrative access to your application.
This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Using labels on web requests and Label metrics and dimensions.
Note
This table describes the latest static version of this rule group. For other versions, use the API command DescribeManagedRuleGroup.
Rule name | Description and label |
---|---|
AdminProtection_URIPATH |
Inspects for URI paths that are generally reserved for administration of a web
server or application. Example patterns include
Rule action: Block Label:
|
Known bad inputs managed rule group
VendorName: AWS
, Name:
AWSManagedRulesKnownBadInputsRuleSet
, WCU: 200
The Known bad inputs rule group contains rules to block request patterns that are known to be invalid and are associated with exploitation or discovery of vulnerabilities. This can help reduce the risk of a malicious actor discovering a vulnerable application.
This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Using labels on web requests and Label metrics and dimensions.
Note
This table describes the latest static version of this rule group. For other versions, use the API command DescribeManagedRuleGroup.
Rule name | Description and label |
---|---|
JavaDeserializationRCE_HEADER |
Inspects the keys and values of HTTP request headers
for patterns indicating Java deserialization Remote
Command Execution (RCE) attempts, such as the Spring
Core and Cloud Function RCE vulnerabilities
(CVE-2022-22963, CVE-2022-22965). Example patterns
include
WarningThis rule only inspects the first 8 KB of the request headers or the first 200 headers, whichever limit is reached first, and it uses the Rule action: Block Label:
|
JavaDeserializationRCE_BODY |
Inspects the request body for patterns indicating
Java deserialization Remote Command Execution (RCE)
attempts, such as the Spring Core and Cloud Function
RCE vulnerabilities (CVE-2022-22963,
CVE-2022-22965). Example patterns include
WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
JavaDeserializationRCE_URIPATH |
Inspects the request URI for patterns indicating
Java deserialization Remote Command Execution (RCE)
attempts, such as the Spring Core and Cloud Function
RCE vulnerabilities (CVE-2022-22963,
CVE-2022-22965). Example patterns include
Rule action: Block Label:
|
JavaDeserializationRCE_QUERYSTRING |
Inspects the request query string for patterns
indicating Java deserialization Remote Command
Execution (RCE) attempts, such as the Spring Core and
Cloud Function RCE vulnerabilities (CVE-2022-22963,
CVE-2022-22965). Example patterns include
Rule action: Block Label:
|
Host_localhost_HEADER |
Inspects the host header in the request for
patterns indicating localhost. Example patterns
include Rule action: Block Label:
|
PROPFIND_METHOD |
Inspects the HTTP method in the request for
Rule action: Block Label:
|
ExploitablePaths_URIPATH |
Inspects the URI path for attempts to access
exploitable web application paths. Example patterns
include paths like Rule action: Block Label:
|
Log4JRCE_HEADER |
Inspects the keys and values of request headers for the presence of
the Log4j vulnerability (CVE-2021-44228 WarningThis rule only inspects the first 8 KB of the request headers or the first 200 headers, whichever limit is reached first, and it uses the Rule action: Block Label:
|
Log4JRCE_QUERYSTRING |
Inspects the query string for the presence of
the Log4j vulnerability (CVE-2021-44228 Rule action: Block Label:
|
Log4JRCE_BODY |
Inspects the body for the presence of
the Log4j vulnerability (CVE-2021-44228 WarningThis rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Rule action: Block Label:
|
Log4JRCE_URIPATH |
Inspects the URI path for the presence of
the Log4j vulnerability (CVE-2021-44228 Rule action: Block Label:
|