Jul 10, 2026
Field note: a pattern I keep running into - people swear their AWS WAF managed rule “does nothing.” It does nothing - because they ordered it wrong. The managed rule only labels the request; a separate rule is meant to read that label and take the action. But they give the label-reading rule a lower priority number, so it runs first, before the label exists. WAF runs rules in priority order, and a rule can only see labels from rules that ran before it. So the label isn’t there yet when the action rule checks for it, so the whole thing just sits there doing nothing. That’s the kind of misconfig I worry about - it never throws an error, never looks broken, it just silently protects nothing.