**Introducing a new console experience for Amazon WAF**

You can now use the updated experience to access Amazon WAF functionality anywhere in the console. For more details, see [Working with the console](https://docs.amazonaws.cn/waf/latest/developerguide/working-with-console.html). 

# Amazon Web Services Marketplace rule groups
<a name="marketplace-rule-groups"></a>

This section explains how to use Amazon Web Services Marketplace rule groups.

Amazon Web Services Marketplace rule groups are available by subscription through the Amazon Web Services Marketplace console at [Amazon Web Services Marketplace](http://www.amazonaws.cn/marketplace). After you subscribe to an Amazon Web Services Marketplace rule group, you can use it in Amazon WAF. To use an Amazon Web Services Marketplace rule group in an Amazon Firewall Manager Amazon WAF policy, each account in your organization must subscribe to it. 

**You can subscribe to different types of rule groups through Amazon Web Services Marketplace:**
+ Amazon WAF partner-managed rule groups
+ Client-side protections

Test and tune any changes to your Amazon WAF protections before you use them for production traffic. For information, see [Testing and tuning your Amazon WAF protections](web-acl-testing.md).

**Amazon Web Services Marketplace Rule Group Pricing**  
Amazon Web Services Marketplace rule groups are available with no long-term contracts, and no minimum commitments. When you subscribe to a rule group, you're charged a monthly fee (prorated hourly) and ongoing request fees based on volume. However, you're only charged the subscription fee when you add the subscribed rule group to a web ACL and begin using it. For more information, see [Amazon WAF Pricing](https://www.amazonaws.cn/waf/pricing/) and the description for each Amazon Web Services Marketplace rule group at [Amazon Web Services Marketplace](http://www.amazonaws.cn/marketplace).

**Have questions about an Amazon Web Services Marketplace rule group?**  
For questions about a rule group that's managed by an Amazon Web Services Marketplace seller and to request changes in functionality, contact the provider's customer support team. To find contact information, see the provider's listing at [Amazon Web Services Marketplace](http://www.amazonaws.cn/marketplace).

The Amazon Web Services Marketplace rule group provider determines how to manage the rule group, for example how to update the rule group and whether the rule group is versioned. The provider also determines the details of the rule group, including the rules, rule actions, and any labels that the rules add to matching web requests. 

## Subscribing to Amazon Web Services Marketplace rule groups
<a name="marketplace-rule-groups-subscribing"></a>

You can subscribe to and unsubscribe from Amazon Web Services Marketplace rule groups on the Amazon WAF console. 

**Important**  
To use an Amazon Web Services Marketplace rule group in an Amazon Firewall Manager policy, each account in your organization must first subscribe to that rule group. 

**To subscribe to an Amazon Web Services Marketplace rule group**

1. Sign in to the Amazon Web Services Management Console and open the Amazon WAF console at [https://console.amazonaws.cn/wafv2/homev2](https://console.amazonaws.cn/wafv2/homev2). 

1. In the navigation pane, choose **Add-on protections**.

1. In the **Amazon Web Services Marketplace** section, choose the name of a rule group to view the details and pricing information.
**Tip**  
Use the filters to quickly sort for the rules you're most interested in. For example, you can use the **Category** filter to view client-side protections only.

1. To subscribe to an Amazon Web Services Marketplace rule group: 

   1. Navigate to a rule group, then choose **Subscribe via Marketplace**.

   1. In the Marketplace page that opens, choose **View purchase options**, then choose **Subscribe**.
**Note**  
If you decide not to subscribe to the rule group, simply close the pop-up.

After you're subscribed to an Amazon Web Services Marketplace rule group, you use it in your protection packs (web ACLs) as you do other managed rule groups. For information, see [Creating a protection pack (web ACL) in Amazon WAF](web-acl-creating.md). 

When adding a rule group to a protection pack (web ACL), you can override the actions of rules in the rule group and of the rule group result. For more information, see [Overriding rule group actions in Amazon WAF](web-acl-rule-group-override-options.md). 

## Unsubscribing from Amazon Web Services Marketplace rule groups
<a name="marketplace-rule-groups-unsubscribing"></a>

You can unsubscribe from Amazon Web Services Marketplace rule groups on the Amazon Web Services Marketplace console.

**Important**  
To stop the subscription charges for an Amazon Web Services Marketplace rule group, you must remove it from all protection packs (web ACLs) in Amazon WAF and in any Firewall Manager Amazon WAF policies, in addition to unsubscribing from it. If you unsubscribe from an Amazon Web Services Marketplace rule group but don't remove it from your protection packs (web ACLs), you will continue to be charged for the subscription. 

**To unsubscribe from an Amazon Web Services Marketplace rule group**

1. Remove the rule group from all protection packs (web ACLs). For more information, see [Editing a protection pack (web ACL) in Amazon WAF](web-acl-editing.md).

1. Open the Amazon console at [https://console.aws.amazon.com/marketplace](https://console.aws.amazon.com/marketplace).

   The **Manage subscriptions page appears**.

1. Open the **Delivery method** list and choose **SaaS**.

1. Under **Agreement**, open the **Actions list** and choose **Cancel subscription** next to the name of the rule group that you want to unsubscribe from.

1. In the **Cancel subscription** dialog box, enter **confirm**, then choose **Yes, cancel subscription**.

## Troubleshooting Amazon Web Services Marketplace rule groups
<a name="waf-managed-rule-group-troubleshooting"></a>

If you find that an Amazon Web Services Marketplace rule group is blocking legitimate traffic, you can troubleshoot the problem by performing the following steps.

**To troubleshoot an Amazon Web Services Marketplace rule group**

1. Override the actions to count for the rules that are blocking legitimate traffic. You can identify which rules are blocking specific requests using either the Amazon WAF sampled requests or Amazon WAF logs. You can identify the rules by looking at the `ruleGroupId` field in the log or the `RuleWithinRuleGroup` in the sampled request. You can identify the rule in the pattern `<Seller Name>#<RuleGroup Name>#<Rule Name>`.

1. If setting specific rules to only count requests doesn't solve the problem, you can override all of the rule actions or change the action for the Amazon Web Services Marketplace rule group itself from **No override** to **Override to count**. This allows the web request to pass through, regardless of the individual rule actions within the rule group. 

1. After overriding either the individual rule action or the entire Amazon Web Services Marketplace rule group action, contact the rule group provider‘s customer support team to further troubleshoot the issue. For contact information, see the rule group listing on the product listing pages on Amazon Web Services Marketplace.

### Contacting Amazon support
<a name="waf-managed-rule-group-troubleshooting-support"></a>

For problems with Amazon WAF or a rule group that is managed by Amazon, contact Amazon Web Services Support. For problems with a rule group that is managed by an Amazon Web Services Marketplace seller, contact the provider's customer support team. To find contact information, see the provider's listing on Amazon Web Services Marketplace.