When a web request body exceeds the body inspection size limit , the underlying host service forwards only contents that are within the limit to AWS WAF. AWS WAF doesn't detect cross-site scripting (XSS) attacks or SQL injection patterns in the web request body beyond the limit.
Note: AWS WAF doesn't log contents of the web request body whether or not it finds an attack pattern within the body inspection size limit.
To protect against attack patterns that don't appear within the body inspection size limit for oversize requests, configure a rule that blocks all oversize requests. Then, create a rule that explicitly allows legitimate oversize requests. You can either create a custom rule, or use the core rule set (CRS) managed rule group .
Use a CRS managed rule
To use the CRS managed rule group, turn on the SizeRestrictions_Body rule to block requests that exceed 8 KB (8,192 bytes). Then, create a rule that allows legitimate requests that exceed the size limit.
Turn on the SizeRestrictions_Body rule
Complete the following steps:
Open the AWS WAF console .
For Region, choose the AWS region where you created your protection pack. Note: If your web ACL is set up for Amazon CloudFront, then select Global .
In the pane, choose Resources & protection packs .
On the right side of protection pack, select the icon to region name to choose the protection pack.
In your selected protection pack, select Rules .
Select View and edit to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules choose Add rules .
Choose AWS-managed rule group and select .
Under Free rules , select Core rule set .
To inspect and block web request bodies that exceed 8 KB, set the SizeRestrictions_BODY rule to Block .
To reduce the occurrence of false positives, use only the SizeRestrictions_Body rule and override all other rules to Count .
Create a rule that allows legitimate requests
The SizeRestrictions_Body rule might block legitimate requests that exceed 8 KB. To allow legitimate requests that exceed the size limit, set the SizeRestrictions_BODY rule to Count . Then, use the labels that AWS WAF adds for subsequent rule evaluation.
Complete the following steps:
Open the AWS WAF console .
For Region, choose the AWS region where you created your protection pack. Note: If your web ACL is set up for Amazon CloudFront, then select Global .
In the pane, choose Resources & protection packs .
On the right side of protection pack, select the icon to region name to choose the protection pack.
In your selected protection pack, select Rules .
Select View and edit to Rules to view or modify the rules associated with your protection pack.
Choose AWSManagedRulesCommonRuleSet .
For SizeRestrictions_BODY rule, choose Override to Count .
Choose Custom rule and select .
Choose Custom rule again and select .
To set up your rule, configure the following values: For Action , choose Block . For Name , enter a rule name. For If a request , choose matches all the statements (AND) For Statement 1 , enter the following information: For Inspect , choose Has a label . For Match scope , choose Label . For Match key , enter the label awswaf:managed:aws:core-rule-set:SizeRestrictions_Body . For Statement 2 , enter the following information: Choose Negate statement results . For Inspect , choose URI path . For Match type , choose Exactly matches string . For String to match , enter /upload . Note: Replace /upload with your URI path where you make requests.
(Optional) For text transformation , choose a text transformation , or choose None .
For Set rule priority , choose Edit rule order. Move the rule to a position after the CRS managed rule group. Note: The SizeRestrictions_Body rule in the CRS can now add a label, and AWS WAF can use the label in subsequent rules.
Choose Save rule order .
Note: It's a best practice to test rules in a non-production environment with Action set to Count . To evaluate the rule, use Amazon CloudWatch metrics with AWS WAF sampled requests or AWS WAF logs.
Create a custom body inspection rule
Set up the oversize request handling action for the rule
When you configure a custom body inspection rule, you can choose the oversize request handling action. Oversize handling tells AWS WAF what to do with a web request when the request body exceeds the size limit. The options to handle oversize components include Continue , Match , and No match . On the AWS WAF console, you must choose one of these options. Outside the console, the default option is set to Continue . To block oversize requests, create a custom rule that uses the oversize request handling action.
Create a rule that allows legitimate requests
To allow legitimate requests that exceed the size limit, create a rule that explicitly allows requests from legitimate hosts . Then, update the rule's priority so that it's higher than the priority of the rule that blocks the request.
Why does AWS WAF block my legitimate upload request?
Hey in Step 6 in the second part of the instructions I think you mean for people to create a rule following the core rule set and then to select has a label. But you don't actually say to create a rule in an otherwise step by step set of instructions. I think I understand what needs to happen and I got there eventually but this post kinda confused it for a bit.
Please let me know if I'm still misunderstanding.
Thank you for your . We'll review and update the Knowledge Center article as needed.
Hi, agree with Ken. I'm stuck on step 6 and need help
Finally, I figure out the solution. Basically, the solution is to create a new rule that "Label" your legitimate request and then modify original CRS SizeRestrictions_Body rule to allow that label.
However, I choose a short cut that I create a new rule that Allow my legitimate request and move the rule to priority higher than CRS.
Can AWS WAF enforce request body size limits beyond its inspection threshold? Hanz asked 3 months ago
Handling oversize web request components in AWS WAF Abhimanyu asked 3 years ago
How to handle CloudFront 403 errors for large POST requests when WAF allows the request? naruto asked 9 months ago
How do I handle WAF Size Constraint rules? rePost-User-1480947 asked 4 years ago
How do I allow requests from an oversized request body to pass through WAF? tong_K asked 3 years ago
How do I use AWS WAF to block specific file extension uploads? AWS OFFICIAL Updated a year ago
How do I exclude specific URIs from XSS or SQLi inspection for HTTP requests in AWS WAF? AWS OFFICIAL Updated 7 months ago
How do I use AWS WAF to block HTTP requests that don't contain a user agent header? AWS OFFICIAL Updated a year ago
How do I explicitly allow file uploads that an AWS WAF rule blocks without excluding the rule? AWS OFFICIAL Updated 2 months ago
DDoS Resilience with AWS WAF EXPERT Joanna K published a year ago
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
