Question

A company deploys AWS WAF on an Application Load Balancer using the AWS Managed Rules 'SQLi Database' rule group. After enabling it in block mode, legitimate users report that some form submissions containing valid text (such as product descriptions with SQL-like keywords) are being blocked with HTTP 403 responses. The security team must reduce these false positives while retaining protection against genuine SQL injection attacks. What is the MOST appropriate approach?

Accepted Answer

Identify the specific rule within the managed rule group causing the false positives, set that individual rule to Count, and add a scoped-down custom rule or label match to allow the affected request patterns.

Answer

Remove the SQLi Database managed rule group entirely and rely on the ALB's built-in request validation to block SQL injection.

Answer

Switch the entire web ACL default action to Allow so that only explicitly matched malicious requests are blocked.

Answer

Increase the rate-based rule threshold so that the SQLi rule group evaluates fewer requests per five-minute window.