aws security_error ai_generated true

403 Forbidden: Request blocked by AWS WAF

ID: aws/aws-waf-rule-blocked

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
80Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
2 active — — —

Root Cause

AWS WAF blocked the request because it matched a rule in the Web ACL (IP reputation, rate limiting, SQL injection, etc.).

generic

Workarounds

  1. 90% success Check WAF sampled requests and logs to identify which rule blocked the request 
    Enable WAF logging to S3/CloudWatch, use aws wafv2 get-sampled-requests to see which rule matched

    Sources: https://docs.aws.amazon.com/waf/latest/developerguide/logging.html

  2. 85% success Add a scope-down statement or IP set exception for legitimate traffic 
    Create an IP set with trusted IPs and add a NOT condition to the blocking rule, or use a label-based exception

    Sources: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-scope-down-statements.html

Dead Ends

Common approaches that don't work:

  1. Disable WAF entirely to unblock requests 90% fail

    Removing WAF exposes the application to all web attacks it was configured to prevent

  2. Set all rules to Count mode permanently 80% fail

    Count mode logs but does not block; application remains unprotected while appearing monitored

Error Chain

Leads to:
Preceded by:
Frequently confused with: