WAF rule that matches URI AND does NOT contain a string in a header

Hi Trever,

This is definitely possible in WAFv2, however you will need to use the JSON editor as nesting statement is not supported through visual rule builder at the moment. Please see sample JSON code below (copy and paste to the JSON editor):

{
  "Name": "RuleContainingURIMatchAndNotHeader",
  "Priority": 0,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RuleContainingURIMatchAndNotHeader"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "UriPath": {}
            },
            "PositionalConstraint": "CONTAINS",
            "SearchString": "my-uri-string",
            "TextTransformations": [
              {
                "Type": "NONE",
                "Priority": 0
              }
            ]
          }
        },
        {
          "NotStatement": {
            "Statement": {
              "ByteMatchStatement": {
                "FieldToMatch": {
                  "SingleHeader": {
                    "Name": "MyHeader"
                  }
                },
                "PositionalConstraint": "CONTAINS",
                "SearchString": "header-s",
                "TextTransformations": [
                  {
                    "Type": "NONE",
                    "Priority": 0
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }
}

Note that once you go into JSON editor and write rule, you cannot return to the visual rule builder.

If you wish to learn more, I also recommend signing up for future webinar where we will do deep dive into rule writing: https://pages.awscloud.com/AWS-Online-Tech-Talks_2020_0317-SID.html

Thanks,