What do I do if I exceed my resource quota in AWS WAF?

Short description

Resources have different quotas in AWS WAF. It's a best practice to consolidate or revise your existing resources. If you can't consolidate your resources, then you can submit a quota increase request.

Note: Some resources have fixed quotas that you can't change.

Resolution

The following resolution focuses on what to do if you exceed your protection pack, regex pattern sets, or IP sets quota.

Protection pack

If you exceed your protection pack quota, then you receive the following errors:

"AWS WAF: WAFLimitsExceededException: AWS WAF couldn't perform the operation because you exceeded your resource limit NUM_WEBACLS_BY_ACCOUNT"

To consolidate your protection packs, create one protection pack to use for different resources. It's not a best practice to create a protection pack for each resource.

Some resources, such as Amazon CloudFront distributions, create a new protection pack as part of the creation process. If the new protection pack exceeds your current quota, then associate your distributions to an existing protection pack.

Note: When you add a protection pack to existing resources, AWS WAF removes and replaces the resource's previous protection pack connection.

Associate your CloudFront distributions to existing web ACLs for AWS WAF

To associate your CloudFront distribution to existing web ACLs for AWS WAF, see Associating protection with an AWS resource.

If you still exceed your quota, then submit a quota increase request for AWS WAF.

Regex pattern sets

If you exceed your regex pattern set quota, then you receive the following errors:

"AWS WAF: WAFLimitsExceededException: AWS WAF couldn't perform the operation because you exceeded your resource limit NUM_REGEX_PATTERN_SETS_BY_ACCOUNT"

When you exceed your quota, expand or consolidate your existing regex pattern sets. If you still exceed your quota, then submit a quota increase request for AWS WAF.

IP sets

If you exceed your IP set quota, then you receive the following errors:

"In AWS WAF: WAFLimitsExceededException: AWS WAF couldn't perform the operation because you exceeded your resource limit NUM_IP_SETS_BY_ACCOUNT"

It's a best practice to consolidate your IP sets. IP sets can support multiple IP addresses in CIDR notation. You can use IP sets for any web ACLs in your AWS Region.

To add CIDR ranges to your existing IP sets, complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose IP sets.
3. Select your IP set.
   Note: You can find IP sets that you created for CloudFront under the us-east-1 region.
4. For IP addresses, enter your IP address CIDR range.
   Note: You can add multiple IP address CIDR ranges separated by commas or new lines.
5. Choose Save.

If you can't consolidate your IP sets, then you can submit a quota increase request for AWS WAF.

Related information

IP sets and regex pattern sets in AWS WAF

Why do I get a limit exceeded error when I add rules to AWS WAF?