WAF restriction and authenticated requests

While it's understandable that you want to allow authenticated requests larger than 8KB to pass through, it's important to note that the 8KB limit you're encountering is not a universal restriction for all AWS WAF implementations.

First, let's clarify the limits:

• For Application Load Balancer and AWS AppSync, there is indeed a fixed 8KB (8,192 bytes) limit for body inspection.
• However, for services like CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is actually 16KB (16,384 bytes), and this can be increased.

Since you mentioned you're using API Gateway and Cognito, you have more flexibility. You can increase the body inspection limit up to 64KB in 16KB increments (16KB, 32KB, 48KB, 64KB). This can be done in your web ACL configuration, though be aware that increasing the limit beyond 16KB may incur additional processing fees.

Regarding your suggestion to "ignore" the restriction for authenticated requests: While authentication does add a layer of security, it's generally not recommended to completely bypass WAF inspection for authenticated users. Authenticated users could still potentially send malicious payloads, either intentionally or if their credentials are compromised.

Instead, consider the following approaches:

1. Increase the body inspection limit in your web ACL configuration to accommodate your larger requests.
2. If you absolutely need to allow larger payloads for authenticated users, you could create a separate rule in your WAF configuration that applies different inspection criteria or limits for authenticated requests. However, this should be done cautiously and with additional security measures in place.
3. If your payloads are consistently larger than the maximum WAF inspection size, you might need to explore alternative architectures, such as using pre-signed URLs for larger data transfers or breaking larger requests into smaller chunks.

Remember, WAF is just one layer of your security strategy. Ensure you have other security measures in place within your API Gateway and Lambda functions to validate and sanitize incoming data, regardless of its size or the authentication status of the user.

Sources
JsonBody - AWS WAFV2
Body - AWS WAFV2
Managing body inspection size limits for AWS WAF - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced