Question

A retail company deploys AWS WAF on an Application Load Balancer using the AWS Managed Rules Core rule set and SQL database rule group. Shortly after enabling the rules in blocking mode, customers report that legitimate checkout requests containing product descriptions with SQL-like text (e.g., 'SELECT premium bundle') are being rejected with HTTP 403 errors. The security team must reduce false positives for this specific rule without disabling protection against real SQL injection attacks across the rest of the application. What is the MOST appropriate action?

Accepted Answer

Override the specific offending rule within the managed rule group to Count mode, review CloudWatch/WAF logs to confirm it is the cause, then add a scoped-down rule or label match to allow the legitimate pattern.

Answer

Disable the entire SQL database managed rule group so the checkout requests are no longer inspected.

Answer

Lower the ALB's idle timeout and increase the WAF web ACL default action to Allow to prevent the 403 responses.

Answer

Replace AWS WAF with a rate-based rule only, since managed rule groups cannot be tuned for individual applications.