In short. Use a non-terminating Count action to label a bot match, then inspect it with a later label match rule and observation data.
Definition: An AWS WAF label is metadata that a matching rule adds to a web request. A rule with the Count action can add a label while evaluation continues, and a later label match rule can inspect that label before a final request action is applied.
Key facts
- AWS WAF keeps a label available on the request until the current protection pack, also called a web ACL, evaluation ends. The request labeling documentation says later rules can access it through a label match statement.
- The Count action records a matching request and is non-terminating. AWS WAF's rule action documentation says evaluation continues through the remaining rules.
- A label match statement sees labels already added by earlier rules in the same web ACL evaluation. The label match documentation describes the rule's label and namespace scopes.
- For a rule group that adds labels, AWS documents overriding matching rules to Count and placing a later rule after the group to handle the request from those labels.
- Label metrics are available in Amazon CloudWatch. AWS also documents label summaries in the WAF console and labels in logs.
How does the non-terminating observation flow work?
AWS WAF describes rule actions as terminating or non-terminating. A Count match records the request, keeps web ACL evaluation moving, and can add labels for rules that follow. The request labeling guide describes the corresponding pattern: configure matching rules with Count and labels, then add later rules that evaluate label combinations.
For bot observation, the matching rule can be a rule in a managed rule group. AWS says many managed rule group rules add labels that identify the rule match or add information about it. When a rule group is configured so that matching rules count, a later rule can inspect the labels while the request remains in the current evaluation flow.
How does a later rule match a bot label?
The label match rule documentation states that the statement compares request labels with a string specification. It can match the full label name with the Label scope, or a namespace with the Namespace scope. Its key must contain the label name for a label match, while a namespace match uses namespaces and can include the prefix with an ending colon.
The ordering requirement is strict. A label match statement can see labels only from rules evaluated earlier in the same web ACL. The observation rule therefore follows the rule or rule group that applies the bot label. AWS's labeling documentation names Bot Control categories as an example of managed rule group labels that can be forwarded to an origin as request headers.
Request option: Has label
Match scope: Label
Key: <label name>
The console exposes this configuration through the rule builder's Has label request option. The API exposes the same statement as LabelMatchStatement.
Where can the observation be read?
Use Count for the later label match rule when the purpose is measurement. The rule action documentation says Count does not choose allow or block and that AWS WAF continues with the remaining rules. This lets the label match rule provide a count while another later action retains responsibility for the request decision.
AWS WAF's labeling documentation says labels on web requests generate Amazon CloudWatch label metrics. The label match documentation adds that label information is summarized in the WAF console and is also present in logs. Labels themselves last only for the current web ACL evaluation, so the metrics, summaries, and logs are the documented places to inspect the signal after evaluation.
Related terms
- When can a later AWS WAF rule match a label added by another rule?
- How do AWS WAF Bot Control inspection levels differ?
- How do AWS WAF Bot Control rules treat verified bots?
FAQ
Does the Count action block a bot request?
No. Count records the match and lets AWS WAF continue evaluating the remaining rules. You can use a later rule for the request decision.
Can a later label match rule inspect any label in the web ACL?
No. It can inspect labels added by rules evaluated earlier in the same web ACL evaluation. Labels from a later rule are unavailable to it.
Where can you inspect the bot match signal?
You can inspect label metrics in CloudWatch, label summaries in the AWS WAF console, and labels in AWS WAF logs.
Sources
- AWS, "Web request labeling in AWS WAF", undated
- AWS, "Using rule actions in AWS WAF", undated
- AWS, "Label match rule statement", undated
Check how a page reads to answer engines. Open the GEO score analyzer