WAF logging examples

docs.aws.amazon.com • September 1, 2026

You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console .

This section provides examples for logging protection pack (web ACL) traffic.

AWS WAF currently reports the location for JSON body inspection as UNKNOWN .

The following log listing is for a web request that matched a rule with CAPTCHA action. The web request has a valid and unexpired CAPTCHA token, and is only noted as a CAPTCHA match by AWS WAF, similar to the behavior for the Count action. This CAPTCHA match is noted under nonTerminatingMatchingRules .

The following log listing is for a web request that matched a rule with CAPTCHA action. The web request didn't have a CAPTCHA token, and was blocked by AWS WAF.

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AWS WAF Enhancements for Logging and CAPTCHA Actions On September 1, 2026, AWS announced updates to its WAF logging features, enhancing the logging of CAPTCHA and Challenge actions. The updates allow users to differentiate between terminating and non-terminating actions based on the presence of failure reasons in the logs. Specifically, the logs now include detailed information about the CAPTCHA and Challenge action statuses, including response codes and timestamps. The updates apply to web requests processed by AWS WAF, which is used to protect applications from common web exploits. These enhancements improve the visibility of web traffic and help organizations better understand their security posture. No specific vulnerabilities or exploits were reported in the articles, focusing instead on the functionality of AWS WAF. 2 sources 6

Extracted Entities

Companies (1)

AWS