WAF Custom Rule Error

Question

I’m trying to create a custom AWS WAF rule to allow SendGrid webhook traffic, but I keep running into an error even when I try very simple statements.

**Issue:**

I’m using the AWS WAF Console visual builder to create a new custom rule.

I want to match:

* URI Path = /sg-webhook
* User-Agent = SendGrid Event API
* Size constraint for header X-Twilio-Email-Event-Webhook-Signature > 30

I’ve tried both the visual builder and the JSON editor.

**Error message:**

```
WAFInvalidParameterException
Error reason: INVALID_FORMAT, field: BYTE_MATCH_STATEMENT, parameter: ByteMatchStatement
```

**JSON I’m trying to use:**

```
{
  "Name": "AllowSendGridWebhook",
  "Priority": 1,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowSendGridWebhook"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "SearchString": "/sg-webhook",
            "FieldToMatch": { "UriPath": {} },
            "TextTransformations": [
              { "Type": "NONE", "Priority": 0 }
            ],
            "PositionalConstraint": "EXACTLY"
          }
        },
        {
          "ByteMatchStatement": {
            "SearchString": "SendGrid Event API",
            "FieldToMatch": { "SingleHeader": { "Name": "User-Agent" } },
            "TextTransformations": [
              { "Type": "NONE", "Priority": 0 }
            ],
            "PositionalConstraint": "EXACTLY"
          }
        },
        {
          "SizeConstraintStatement": {
            "FieldToMatch": { "SingleHeader": { "Name": "X-Twilio-Email-Event-Webhook-Signature" } },
            "ComparisonOperator": "GT",
            "Size": 30,
            "TextTransformations": [
              { "Type": "NONE", "Priority": 0 }
            ]
          }
        }
      ]
    }
  }
}
```

**What I’ve tried:**

Stepwise building the rule (adding statements one at a time)

Using base64-encoded SearchString

Checking key order inside ByteMatchStatement

I have even tried not using any ByteMatchStatements and I still get the same error message

**Question:**

Why is AWS WAF still giving me INVALID_FORMAT on ByteMatchStatement even when I remove or simplify statements?

Is there something subtle in the Console visual builder or JSON editor that might be causing this?

How can I successfully create a rule that matches these headers and the URI for SendGrid webhooks?

Any guidance or example working JSON for this scenario would be greatly appreciated.

Riku_Kobayashi · Answer

Hello.

I have confirmed that the WAF rule you created can be successfully registered in my AWS account.  
![a](/media/postImages/original/IMwC6ZWGrWRxyOxiydawSYBQ)

Therefore, I think that the problem might not be with the WebACL JSON, but with the environment in which the operation was being performed.  
For example, why not try registering using the AWS CLI instead of the management console?  
https://docs.aws.amazon.com/cli/latest/reference/wafv2/update-web-acl.html

mofaized-AWS · Answer

This likely indicates a problem with an existing rule within your WebACL. Check your WebACL for other rules that might be malformed, specifically any using the 'CONTAINS_WORD' byte match statement, and correct them. If you're still not sure what the problem is, try re-creating the WebACL and it should flag the problematic rule for you and then you can insert your new rule above.

mofaized-AWS

answered a year ago

re:Post Agent · Answer

The error you're encountering with your AWS WAF rule is likely due to formatting issues in your ByteMatchStatement. Here are the key issues and how to fix them:

1. **SearchString Format**: For ByteMatchStatement, the SearchString needs to be properly formatted. If you're using plain text (not base64), ensure there are no special characters causing issues.

2. **PositionalConstraint Value**: The value "EXACTLY" for PositionalConstraint is incorrect. Valid values for PositionalConstraint are:
- EXACTLY
- STARTS_WITH
- ENDS_WITH
- CONTAINS
- CONTAINS_WORD

3. **Rule Structure**: Each rule in AWS WAF requires a Statement that defines how to identify matching web requests, along with parameters that determine how AWS WAF handles them.

Here's a corrected approach for your rule:

1. Start with a simple rule first (just one condition) to ensure it works
2. Make sure your ByteMatchStatement includes all required fields with correct values
3. Gradually add more conditions once the basic structure works

For your specific use case, I recommend:

1. First create a rule with just the URI path match
2. Then add the User-Agent match
3. Finally add the size constraint for the header

When building complex rules with multiple conditions, it's often easier to start simple and build up incrementally to identify exactly where the error occurs. The AWS WAF console visual builder can help ensure proper formatting of each statement before combining them.

Remember that each rule requires a name, priority, statement (for matching criteria), and visibility configuration. The action (Allow/Block/Count) determines what happens when a request matches your rule.  
**Sources**  
[Rule - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html)  
[WafAction - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WafAction.html)  
[WafAction - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_WafAction.html)  
[RuleSummary - AWS WAFV2](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RuleSummary.html)

WAF Custom Rule Error

Add your answer

Relevant content