Question

A company runs a public web application behind Amazon CloudFront with an AWS WAF web ACL attached. The web ACL contains, in this order: (1) a rate-based rule, (2) the AWS Managed Rules Core Rule Set (CRS), and (3) a custom rule that explicitly allows requests from the company's corporate IP set for administrative access. After deployment, administrators report that legitimate admin requests from the corporate IP range are being blocked, even though the traffic is not malicious. What is the MOST likely cause and the correct remediation?

Accepted Answer

The Core Rule Set is evaluated before the custom Allow rule and terminates matching requests; move the custom Allow rule above the Core Rule Set in priority order.

Answer

Rate-based rules cannot coexist with managed rule groups; remove the rate-based rule so the custom Allow rule can take effect.

Answer

CloudFront caches the WAF decision; invalidate the CloudFront distribution cache so the Allow rule is re-evaluated.

Answer

Allow rules are ignored inside a web ACL that contains managed rule groups; convert the custom rule to a Count action instead.