AWS WAF: Overriding Rule Actions in a Rule Group

Steps to Override Rule Actions

1. Access the Web ACL:

• Navigate to the Rules tab of the web ACL page.
• Select the rule group and click Edit.

2. Manage Rule Actions:

All Rules:

• Open the Override all rule actions dropdown.
• Select the desired override action or choose Remove all overrides to clear them.

Single Rule:

• Open the dropdown for the specific rule.
• Select the override action or choose Remove override to clear it.

3. Save Changes

• Click Save rule to apply your changes.
• The updated rule actions and override settings are displayed on the rule group page.

Here is the example of the JSON configuration or overriding rule actions:

{
    "Name": "AWS-AWSBotControl",
   "Priority": 7, 
   "Statement": {
    "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesBotControlRuleSet",
        "RuleActionOverrides": [
          {
            "ActionToUse": {
              "Count": {}
            },
            "Name": "CategoryVerifiedSearchEngine"
          },
          {
            "ActionToUse": {
              "Count": {}
            },
            "Name": "CategoryVerifiedSocialMedia"
          }
        ],
        "ExcludedRules": []
    },
   "VisibilityConfig": {
       "SampledRequestsEnabled": true,
       "CloudWatchMetricsEnabled": true,
       "MetricName": "AWS-AWSBotControl"
   }
}