/**
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
* SPDX-License-Identifier: Apache-2.0.
*/
#pragma once
#include This is AWS WAF Classic documentation. For more information,
* see AWS
* WAF Classic in the developer guide. For the latest version of AWS
* WAF, use the AWS WAFV2 API and see the AWS
* WAF Developer Guide. With the latest version, AWS WAF has a single set of
* endpoints for regional and global use. The
* To
* specify whether to insert or delete a ActivatedRule object in an UpdateWebACL request specifies a
* Rule that you want to insert or delete, the priority of the
* Rule in the WebACL, and the action that you want AWS
* WAF to take when a web request matches the Rule
* (ALLOW, BLOCK, or COUNT).Rule, use the
* Action parameter in the WebACLUpdate data
* type.See Also:
AWS
* API Reference
Specifies the order in which the Rules in a WebACL
* are evaluated. Rules with a lower value for Priority are evaluated
* before Rules with a higher value. The value must be a unique
* integer. If you add multiple Rules to a WebACL, the
* values don't need to be consecutive.
Specifies the order in which the Rules in a WebACL
* are evaluated. Rules with a lower value for Priority are evaluated
* before Rules with a higher value. The value must be a unique
* integer. If you add multiple Rules to a WebACL, the
* values don't need to be consecutive.
Specifies the order in which the Rules in a WebACL
* are evaluated. Rules with a lower value for Priority are evaluated
* before Rules with a higher value. The value must be a unique
* integer. If you add multiple Rules to a WebACL, the
* values don't need to be consecutive.
Specifies the order in which the Rules in a WebACL
* are evaluated. Rules with a lower value for Priority are evaluated
* before Rules with a higher value. The value must be a unique
* integer. If you add multiple Rules to a WebACL, the
* values don't need to be consecutive.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
The RuleId for a Rule. You use RuleId
* to get more information about a Rule (see GetRule), update a
* Rule (see UpdateRule), insert a Rule into a
* WebACL or delete a one from a WebACL (see
* UpdateWebACL), or delete a Rule from AWS WAF (see
* DeleteRule).
RuleId is returned by CreateRule
* and by ListRules.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Specifies the action that CloudFront or AWS WAF takes when a web request
* matches the conditions in the Rule. Valid values for
* Action include the following:
ALLOW:
* CloudFront responds with the requested object.
* BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status
* code.
COUNT: AWS WAF increments a counter of
* requests that match the conditions in the rule and then continues to inspect the
* web request based on the remaining rules in the web ACL.
* ActivatedRule|OverrideAction applies only when updating or adding a
* RuleGroup to a WebACL. In this case, you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you
* set the OverrideAction to None, the
* RuleGroup will block a request if any individual rule in the
* RuleGroup matches the request and is configured to block that
* request. However if you first want to test the RuleGroup, set the
* OverrideAction to Count. The RuleGroup
* will then override any block action specified by individual rules contained
* within the group. Instead of blocking matching requests, those requests will be
* counted. You can view a record of counted requests using
* GetSampledRequests.
ActivatedRule|OverrideAction
* applies only when updating or adding a RuleGroup to a
* WebACL. In this case you do not use
* ActivatedRule|Action. For all other update requests,
* ActivatedRule|Action is used instead of
* ActivatedRule|OverrideAction.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
The rule type, either REGULAR, as defined by Rule,
* RATE_BASED, as defined by RateBasedRule, or
* GROUP, as defined by RuleGroup. The default is REGULAR.
* Although this field is optional, be aware that if you try to add a RATE_BASED
* rule to a web ACL without setting the type, the UpdateWebACL request will
* fail because the request tries to add a REGULAR rule with the specified ID,
* which does not exist.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.
An array of rules to exclude from a rule group. This is applicable only when
* the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking * traffic unexpectedly (false positives). One troubleshooting technique is to * identify the specific rule within the rule group that is blocking the legitimate * traffic and then disable (exclude) that particular rule. You can exclude rules * from both your own rule groups and AWS Marketplace rule groups that have been * associated with a web ACL.
Specifying ExcludedRules does not
* remove those rules from the rule group. Rather, it changes the action for the
* rules to COUNT. Therefore, requests that match an
* ExcludedRule are counted but not blocked. The
* RuleGroup owner will receive COUNT metrics for each
* ExcludedRule.
If you want to exclude rules from a rule group * that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to * exclude. For more information about the logs, see Logging * Web ACL Traffic Information.
Submit an UpdateWebACL * request that has two actions:
The first action deletes the
* existing rule group from the web ACL. That is, in the UpdateWebACL
* request, the first Updates:Action should be DELETE and
* Updates:ActivatedRule:RuleId should be the rule group that contains
* the rules that you want to exclude.
The second action inserts
* the same rule group back in, but specifying the rules to exclude. That is, the
* second Updates:Action should be INSERT,
* Updates:ActivatedRule:RuleId should be the rule group that you just
* removed, and ExcludedRules should contain the rules that you want
* to exclude.