AWS WAFV2: ACL Rule for allowing access to specific URI Path

Viewed 916

I have some web acl managed rules in AWS ELB that are blocking webhooks from Pusher api. They don't provide an IP list that I could include in a white list. I'm trying to create my own rule to allow access to this specific URI /assets/libs/pusher_webhook_presence.php but it doesn't works and keeps blocking by AWS#AWSManagedRulesAnonymousIpList#HostingProviderIPList

Acl rule that should allow that uri:

{
  "Name": "Allow_Pusher_Webhooks",
  "Priority": 4,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "Allow_Pusher_Webhooks"
  },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": {
        "UriPath": {}
      },
      "PositionalConstraint": "EXACTLY",
      "SearchString": "/assets/libs/pusher_webhook_presence.php",
      "TextTransformations": [
        {
          "Type": "NONE",
          "Priority": 0
        }
      ]
    }
  }
}

List of managed rules that my web acl has:

Allow_Pusher_Webhooks ( Priority 0 )
AWS-AWSManagedRulesAmazonIpReputationList   
AWS-AWSManagedRulesAdminProtectionRuleSet   
AWS-AWSManagedRulesCommonRuleSet    
AWS-AWSManagedRulesAnonymousIpList

I tried set its priority to 0, so it would be tested at first but no success. What I'm doing wrong or missing?

1 Answers

Not sure if this already fixed. If not change Action = Allow and check.

"Action": { "Allow": {}

Also enable logging. Traffic details will be saved in S3. You can see the IP details against blocked event. (ex: HostingProviderIPList)

Related