Bot Control example: Using two statements to limit the use of the targeted inspection level
As a cost optimization, you can use two Amazon WAF Bot Control managed rule group statements in your web ACL, with separate inspection levels and scoping. For instance, you could scope the targeted inspection level statement only to more sensitive application endpoints.
The two statements in the following example have mutually exclusive scoping. Without this configuration, a request could result in two billed Bot Control evaluations.
Note
Multiple statements referencing AWSManagedRulesBotControlRuleSet
are not supported in the visual editor in the console. Instead, use the JSON editor.
{ "Name": "Bot-WebACL", "Id": "...", "ARN": "...", "DefaultAction": { "Allow": {} }, "Description": "Bot-WebACL", "Rules": [ { ... }, { "Name": "AWS-AWSBotControl-Common", "Priority": 5, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "
AWSManagedRulesBotControlRuleSet
", "ManagedRuleGroupConfigs": [ { "AWSManagedRulesBotControlRuleSet": { "InspectionLevel": "COMMON" } } ], "RuleActionOverrides": [], "ExcludedRules": [] }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AWS-AWSBotControl-Common" }, "ScopeDownStatement": { "NotStatement": { "Statement": { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/sensitive-endpoint", "TextTransformations": [ { "Type": "NONE", "Priority": 0 } ] } } } } } }, { "Name": "AWS-AWSBotControl-Targeted", "Priority": 6, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesBotControlRuleSet
", "ManagedRuleGroupConfigs": [ { "AWSManagedRulesBotControlRuleSet": { "InspectionLevel": "TARGETED", "EnableMachineLearning": true } } ], "RuleActionOverrides": [], "ExcludedRules": [] }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AWS-AWSBotControl-Targeted" }, "ScopeDownStatement": { "Statement": { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/sensitive-endpoint", "TextTransformations": [ { "Type": "NONE", "Priority": 0 } ] } } } } } ], "VisibilityConfig": { ... }, "Capacity": 1496, "ManagedByFirewallManager": false, "RetrofittedByFirewallManager": false }