如何有选择地仅针对 CloudFormation 中的特定 URI 覆盖 WAF 规则？

【以下的回答经过翻译处理】 经过与南非开普敦出色的 AWS 员工进行了数小时的通话，然后进行了更多的试验和错误，我们决定采用以下实施方式：

以下是一个完整的示例（除了实际将资源与 WAF 关联之外），具有简单的日志记录以方便调试。 仅允许 /uri1、/uri2 和 /uri3 上的 CrossSiteScripting_BODY 和 GenericLFI_BODY。 将 WebACL 流量记录到 CloudWatch，这样我们就不必担心 S3 权限以及 AWS Glue 和 Athena 来查询 WAF 日志。 编辑敏感信息。 如下：

AWSTemplateFormatVersion: '2010-09-09'
Description: WAF implementation that allows exclusions for specific URIs
Transform: AWS::Serverless-2016-10-31
Parameters:
  ProjectName:
    Description: Project Name
    Type: String

Resources:
  regionalWebAcl:
    Type: AWS::WAFv2::WebACL
    Properties:
      Scope: REGIONAL
      Name: !Sub ${ProjectName}-regional-webacl
      DefaultAction:
        Allow: {}
      VisibilityConfig:
        CloudWatchMetricsEnabled: true
        MetricName: !Sub ${ProjectName}-regional-webacl-metric
        SampledRequestsEnabled: true
      Rules:
        - Name: !Sub ${ProjectName}-regional-webacl-AWSManagedRulesKnownBadInputsRuleSet
          Priority: 5
          OverrideAction:
            None: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: !Sub ${ProjectName}-regional-webacl-AWSManagedRulesKnownBadInputsRuleSet-metric
            SampledRequestsEnabled: true
          Statement:
            ManagedRuleGroupStatement:
              Name: AWSManagedRulesKnownBadInputsRuleSet
              VendorName: AWS
        - Name: !Sub ${ProjectName}-regional-webacl-AWSManagedRulesCommonRuleSet
          Priority: 10
          OverrideAction:
            None: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: !Sub ${ProjectName}-regional-webacl-AWSManagedRulesCommonRuleSet-metric
            SampledRequestsEnabled: true
          Statement:
            ManagedRuleGroupStatement:
              Name: AWSManagedRulesCommonRuleSet
              VendorName: AWS
              RuleActionOverrides:
                - Name: CrossSiteScripting_BODY
                  ActionToUse:
                    Count: {}
                - Name: GenericLFI_BODY
                  ActionToUse:
                    Count: {}
        - Name: !Sub ${ProjectName}-regional-webacl-reblock
          Priority: 15
          RuleLabels:
            - Name: reblock
          Statement:
            AndStatement:
              Statements:
                - OrStatement:
                    Statements:
                      - LabelMatchStatement:
                          Key: awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body # Pay very careful attention to the casing, it's NOT CrossSiteScripting_BODY
                          Scope: LABEL
                      - LabelMatchStatement:
                          Key: awswaf:managed:aws:core-rule-set:GenericLFI_Body  # Pay very careful attention to the casing, it's NOT GenericLFI_BODY
                          Scope: LABEL
                - NotStatement:
                    Statement:
                      RegexMatchStatement:
                        FieldToMatch:
                          UriPath: {}
                        RegexString: ^.*\/(?:uri1|uri2|uri3)$ # Note that this regex is supposed to (according to AWS support that I received) match on the whole field, not just part of it.  Also notice that you don't specify the leading forward slash and the trailing slash with common regex flags.  If you need lowercase, then use a TextTransformation to do that.
                        TextTransformations:
                          - Priority: 0
                            Type: NONE
          Action:
            Block: {}
          VisibilityConfig:
              CloudWatchMetricsEnabled: true
              MetricName: !Sub ${ProjectName}-regional-webacl-reblock-metric
              SampledRequestsEnabled: true

  regionalWebAclLoggingConfiguration:
    Type: AWS::WAFv2::LoggingConfiguration
    Properties:
      LogDestinationConfigs:
        - !GetAtt regionalWebAclLogGroup.Arn
      ResourceArn: !GetAtt regionalWebAcl.Arn
      RedactedFields:
        - SingleHeader:
            Name: authorization
        - QueryString: {} # If you use an auth query string parameter, redact the whole query string
      LoggingFilter:
        DefaultBehavior: DROP
        Filters:
          - Behavior: KEEP
            Requirement: MEETS_ANY
            Conditions:
              - ActionCondition:
                  Action: BLOCK
          - Behavior: KEEP
            Requirement: MEETS_ANY
            Conditions:
              - ActionCondition:
                  Action: COUNT


  regionalWebAclLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub aws-waf-logs-${ProjectName}-regional-webacl
      RetentionInDays: 30

Outputs:
  regionalWebAclArn:
    Value: !GetAtt regionalWebAcl.Arn
  regionalWebAclLogGroupArn:
    Value: !GetAtt regionalWebAclLogGroup.Arn

请注意，规则名称和规则标签所使用的字符相同，但大小写不同，因此您不能简单地从本文档复制并粘贴规则名称

关于RegEx测试，他们推荐了PCRE2模式的这个网站：https://regex101.com/