Question

A company protects its public API behind an Application Load Balancer using an AWS WAF web ACL. The web ACL contains three rules evaluated in this priority order: (1) an AWS Managed Rules Common Rule Set in Block action, (2) a rate-based rule limiting requests to 2,000 per 5 minutes with Block action, and (3) an IP set rule that Allows traffic from the company's trusted partner CIDR ranges. The security team reports that legitimate high-volume automated traffic from a trusted partner is being blocked during peak periods. The team wants trusted partner traffic to bypass the rate-based throttling while still enforcing the rate limit for everyone else. What change best achieves this?

Accepted Answer

Add a scope-down statement to the rate-based rule that excludes the partner CIDR ranges from being counted or rate-limited.

Answer

Move the IP set Allow rule to priority 1 so it is evaluated before the rate-based rule, allowing trusted partner traffic to terminate evaluation early.

Answer

Change the rate-based rule to Count action so it stops blocking any traffic while still logging matches.

Answer

Increase the rate-based rule limit to 20,000 requests per 5 minutes to accommodate the partner's peak volume.