By using AWS re:Post, you agree to the Terms of Use

WAF rule that matches URI AND does NOT contain a string in a header

0

I want to create a WAFv2 rule that matches part of the URI AND does NOT contain a string in one of the headers. I see a match type of "Contains string" but do not see how to negate this. Is this possible?

asked 3 years ago209 views
1 Answer
0

Hi Trever,

This is definitely possible in WAFv2, however you will need to use the JSON editor as nesting statement is not supported through visual rule builder at the moment. Please see sample JSON code below (copy and paste to the JSON editor):

{
  "Name": "RuleContainingURIMatchAndNotHeader",
  "Priority": 0,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RuleContainingURIMatchAndNotHeader"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "UriPath": {}
            },
            "PositionalConstraint": "CONTAINS",
            "SearchString": "my-uri-string",
            "TextTransformations": [
              {
                "Type": "NONE",
                "Priority": 0
              }
            ]
          }
        },
        {
          "NotStatement": {
            "Statement": {
              "ByteMatchStatement": {
                "FieldToMatch": {
                  "SingleHeader": {
                    "Name": "MyHeader"
                  }
                },
                "PositionalConstraint": "CONTAINS",
                "SearchString": "header-s",
                "TextTransformations": [
                  {
                    "Type": "NONE",
                    "Priority": 0
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }
}

Note that once you go into JSON editor and write rule, you cannot return to the visual rule builder.

If you wish to learn more, I also recommend signing up for future webinar where we will do deep dive into rule writing: https://pages.awscloud.com/AWS-Online-Tech-Talks_2020_0317-SID.html

Thanks,

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions