So far it seems to only mean changing ::WAF to ::WAFRegional throughout your code. But this also requires that instead of a normal WebACL you must use the WAFRegional. PFB documentation for ALB access logs format/syntax.To solve this I browsed through their release history and found the CloudFormation resources that were updated to support WAF & ALB įrom there I was able to deduce that the linking component is a WebACLAssociation that maps WAF and ALB. In such scenario, the value of 'action' field will be 'forward'. You will also see 'elb_status_code' to be same because ALB will send the same code to the client. Check if the 'target_status_code' field is 403 in the access logs. On the other hand, if is also possible that the target is sending HTTP 403 and ALB is forwarding it back to the client. If this is the final action, AWS WAF determined that the request should be rejected. If it has the value 'waf', it means The load balancer forwarded the request to AWS WAF to determine whether the request should be forwarded to the target. Access logs for your Application Load Balancer - Actions taken - In case you have access logs enabled, check the 'Actions taken' field in the access logs.

If it has the value 'waf', it means The load balancer forwarded the request to AWS WAF to determine whether the request should be forwarded to the target. In case you have access logs enabled, check the 'Actions taken' field in the access logs. Troubleshoot your Application Load Balancers - HTTP 403: Forbidden.

In case you are using AWS WAF along with ALB, it is likely that the WAF is blocking the request. Step 1: Set up AWS WAF Step 2: Create a Web ACL Step 3: Add a string match rule Step 4: Add an AWS Managed Rules rule group Step 5: Finish your web ACL configuration Step 6: Clean up your resources Step 1: Set up AWS WAF If you haven't already followed the general setup steps in Setting up, do that now.

Waf load balancer