- Newest
- Most votes
- Most comments
The docs that you have linked to regarding terminating and non-terminating rules are referencing the rule Action, as specified when you create the rule. So for your rate-based rules, I'm assuming that you have applied the action of "Block" to the rule. What's important to understand is that when a request does not match a rule, that does not mean that it is applying an action of "Allow". The "Allow" that you are seeing in your sampled logs is likely for the default action for your WebACL, i.e. the request has not matched any of your rules and so the default action applies. For your first rate-based rule, if the request is not hitting the rate-limit in rule 1 it is not being "Allowed", it is simply passing through to the next rule.
Rate-based rules in AWS WAF work differently than standard rules when it comes to action handling and priority.
When a request doesn't trigger the rate limit threshold in a rate-based rule, it doesn't actually apply an "Allow" action that terminates processing. Instead, the request continues to be evaluated against subsequent rules in the web ACL. This is similar to how the "Count" action works - it's non-terminating.
Regarding your example with two rate-based rules (one aggregating header "foo" with higher priority and one aggregating header "bar" with lower priority):
-
If a request with both "foo" and "bar" headers arrives, and the "foo" rule hasn't reached its limit, the request will continue to be evaluated by the "bar" rule. If the "bar" rule has reached its limit, the request will be blocked.
-
For your second question about counting: Yes, requests that pass through the first rule do count toward the quota of the second rule if they match the scope of that rule. So in your example, if you send 9 requests with both "foo" and "bar" headers, and then 9 requests with only "bar" headers, the "bar" rule would count all 18 requests and would block requests once the limit is exceeded.
The scope-down statement in a rate-based rule is critical here. It determines which requests are counted toward the rate limit. If a request doesn't match the scope-down statement of a rule, it won't be counted toward that rule's limit, regardless of priority.
To effectively use rate-based rules with labels, you would typically:
- Add rules that apply labels to requests (with non-terminating actions like Count)
- Add rate-based rules with higher priority numbers (evaluated later) that use scope-down statements to match specific labels
- Configure the rate-based rules to aggregate and limit requests based on those labels
This approach ensures that your labeling happens first, and then rate limiting is applied based on those labels.
Sources
How AWS WAF handles rule and rule group actions in a web ACL - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced
Rate limit the requests with specific labels - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced
AWS WAF Rules not working | AWS re:Post
Relevant content
- asked 9 months ago
- asked 10 months ago
