AWS WAF is blocking CloudWatch's Synthetic Canary


Hello, Is anyone else having issues with the Synthetic Canaries being blocked by the AWS WAF Managed Rules' AWSManagedIPReputationList and/or AWSManagedReconnaissanceList?

Is there a way to let the WAF know that those requests are safe?

Right now my approach has been to whitelist the public IP of the request (but this IP is dynamic os it won't last long) or set to count those rules but then I'm leaving a little bit open the site.

Thanks for you comments. Regards.

1 Answer

One option you have is to configure your Canary to use a specific request header or cookie, then look for the presence of that in a custom WAF rule. You could either allow the traffic and not process any other rules, or you could add a label, which you could then use in a scope-down statement to bypass the rule(s) that are currently blocking your Canary

answered 10 months ago
  • Thanks for the reply. By any change do you have an example of how to insert a custom header in the Canary code, I have very little knowledge of NodeJS.

    Kind Regards.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions