S3 PUT file size limit

The issue you're experiencing with the WAF rule not working as expected for blocking requests with body sizes larger than 20MB could be due to the default size limit that AWS WAF inspects. By default, AWS WAF only inspects the first 16 KB (16,384 bytes) of the request body for most resource types, including CloudFront distributions.

To increase this inspection limit, you need to use the RequestBodyAssociatedResourceTypeConfig feature in AWS WAF. This allows you to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can increase this limit up to 64 KB for CloudFront distributions.

However, even with this increased limit, it won't reach the 20MB threshold you're aiming for. This explains why you were blocked for a 920KB file - it's likely that the WAF was only inspecting the first 16KB of the request.

As for using S3 policies to limit file sizes, unfortunately, S3 doesn't provide a direct way to limit the size of objects being uploaded through a bucket policy. S3 can handle files up to 5TB in size, and there's no built-in mechanism to restrict uploads based on file size at the S3 level.

Given these limitations, you might want to consider alternative approaches:

1. Use a Lambda@Edge function: This would allow you to check the file size before it reaches S3 and reject oversized files.

2. Implement client-side checks: Add file size validation in your application before initiating the upload.

3. Use S3 multipart upload with size limits: If you're using multipart uploads, you can set a maximum part size, which indirectly limits the total file size.

Remember, while these alternatives can help control upload sizes, they may not provide the same level of security as a properly configured WAF rule. Always ensure you have multiple layers of security in place to protect your resources.
Sources
RequestBodyAssociatedResourceTypeConfig - AWS WAFV2