When can a later AWS WAF rule match a label added by another rule?

Definition: An AWS WAF label is metadata that a matching rule adds to a web request. A later rule can match that label during the same protection pack, or web ACL, evaluation when the labeling rule has already run and evaluation has continued to that later rule.

Key facts

• AWS says a label remains available on the request until the protection pack, or web ACL, evaluation ends, and later rules can access it with a label match statement (web request labeling).
• A label match statement inspects labels already added by other rules in the same web ACL evaluation, so it sees labels from rules evaluated earlier (label match rule statement).
• AWS WAF evaluates rules from the lowest numeric priority upward. Each rule needs a unique priority within its web ACL or rule group (setting rule priority).
• Count continues processing the rules that follow, while Allow and Block stop processing later rules (rule and rule group actions).
• The API uses Scope to choose a label or namespace match and Key for the string to match. AWS defines LABEL and NAMESPACE as the valid scope values (LabelMatchStatement).

How does AWS WAF make a label available?

The labeling rule must match the request and run before the rule that reads the label. AWS's label match documentation says that the labels available for inspection are those already added by other rules in the same protection pack, or web ACL, evaluation. It also states that a label match statement can see labels only from rules evaluated earlier in that evaluation.

The label stays on the request for the rest of that web ACL evaluation. AWS's web request labeling documentation describes a label as metadata added when a rule matches and says it remains available until evaluation ends. The label match statement is therefore a later-stage condition in the same request evaluation.

How does rule order affect a label match?

AWS assigns evaluation order through numeric priority. Its rule priority documentation requires unique priority values within the web ACL and within each rule group, then says evaluation starts with the lowest numeric priority and proceeds upward until a terminating match or the end of the rules.

This means the labeling rule needs a lower numeric priority than the label match rule. AWS's labeling example gives a new rule that marks login paths a lower numeric priority than the original rules so it runs first. A label match rule placed earlier in the sequence cannot inspect a label that a later rule has not added.

Actions also control whether the later rule is reached. AWS's rule action documentation says that Count continues processing the following rules. Allow and Block terminate processing, so a later label match rule is not evaluated after either action matches.

What can the label match statement inspect?

The statement compares labels on the request with a string specification. AWS's LabelMatchStatement API reference says the key can represent part or all of a fully qualified label name, whose components are separated by colons. Labels are case sensitive, and Scope selects a label name or a namespace.

{
  "LabelMatchStatement": {
    "Scope": "LABEL",
    "Key": "NS1:NS2:name"
  }
}

The API reference gives NS1:NS2:name as its colon-separated label example and lists LABEL and NAMESPACE as the scope values. A namespace match can therefore target a namespace rather than one complete label name.

Related terms

• How do AWS WAF Bot Control inspection levels differ?
• How can an owned monitoring bot be excluded from AWS WAF Bot Control?
• How can AWS WAF labels be used to observe bot matches without blocking?

FAQ

Does a label remain available after the web ACL evaluation?

No. AWS's label documentation says the label remains available until the protection pack, or web ACL, evaluation ends, while its label match reference says labels do not persist outside that evaluation.

What happens if you give the labeling rule a higher numeric priority?

It runs later because AWS WAF evaluates from the lowest numeric priority upward. The label match rule cannot inspect that label before the labeling rule has run.

Can you use a label after an Allow or Block match?

No. AWS WAF stops processing later rules after either terminating action. A Count match leaves later rules in the evaluation sequence.

Sources

1. AWS, "Web request labeling in AWS WAF", undated
2. AWS, "Label match rule statement", undated
3. AWS, "Setting rule priority", undated
4. AWS, "How AWS WAF handles rule and rule group actions", undated
5. AWS, "LabelMatchStatement", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer