WAF Log Filters Not Dropping Specified Requests

Question

We are attempting to create logging filters for our WAF policies. I created the following conditions for logging:

> Rule action: BLOCK
Keep in logs

> Rule action: ALLOW -
Drop from logs

> 
Default logging behavior
Drop from logs

However, requests with the rule action ALLOW are still being logged. Are there any additional steps I can take to filter out log conditions?

Answer

Hi !

Thanks for reaching out to Re:Post !

Going through the above logging configuration, the reason you are still seeing ALLOW requests in the log is because those requests might be allowed by the default action of the Web ACL if it is set to allow . 
WAF logging filter with rule ACTION does not consider requests acted upon by the default action Web ACL behavior.

Deciding on the default action for a web ACL - https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-default-action.html

WAF Log Filters Not Dropping Specified Requests

Relevanter Inhalt