AWS WAF Regional (Classic)

eventName	Description	Sample	Rule
any	Catch-all entry for AWS WAF Regional (Classic) rules that match the service but not a specific eventName.	N	N
AssociateWebACL	This is AWS WAF Classic Regional documentation.	N	N
CreateByteMatchSet	This is AWS WAF Classic documentation.	Y	N
CreateGeoMatchSet	This is AWS WAF Classic documentation.	Y	N
CreateIPSet	This is AWS WAF Classic documentation.	Y	N
CreateRateBasedRule	This is AWS WAF Classic documentation.	Y	N
CreateRegexMatchSet	This is AWS WAF Classic documentation.	Y	N
CreateRegexPatternSet	This is AWS WAF Classic documentation.	Y	N
CreateRule	This is AWS WAF Classic documentation.	Y	N
CreateRuleGroup	This is AWS WAF Classic documentation.	Y	N
CreateSizeConstraintSet	This is AWS WAF Classic documentation.	Y	N
CreateSqlInjectionMatchSet	This is AWS WAF Classic documentation.	Y	N
CreateWebACL	This is AWS WAF Classic documentation.	Y	N
CreateWebACLMigrationStack	Creates an AWS CloudFormation WAFV2 template for the specified web ACL in the specified Amazon S3 bucket.	N	N
CreateXssMatchSet	This is AWS WAF Classic documentation.	Y	N
DeleteByteMatchSet	This is AWS WAF Classic documentation.	Y	N
DeleteGeoMatchSet	This is AWS WAF Classic documentation.	Y	N
DeleteIPSet	This is AWS WAF Classic documentation.	Y	N
DeleteLoggingConfiguration	This is AWS WAF Classic documentation.	N	N
DeletePermissionPolicy	This is AWS WAF Classic documentation.	N	N
DeleteRateBasedRule	This is AWS WAF Classic documentation.	Y	N
DeleteRegexMatchSet	This is AWS WAF Classic documentation.	Y	N
DeleteRegexPatternSet	This is AWS WAF Classic documentation.	Y	N
DeleteRule	This is AWS WAF Classic documentation.	Y	Y
DeleteRuleGroup	This is AWS WAF Classic documentation.	Y	Y
DeleteSizeConstraintSet	This is AWS WAF Classic documentation.	Y	N
DeleteSqlInjectionMatchSet	This is AWS WAF Classic documentation.	Y	N
DeleteWebACL	This is AWS WAF Classic documentation.	N	Y
DeleteXssMatchSet	This is AWS WAF Classic documentation.	Y	N
DisassociateWebACL	This is AWS WAF Classic Regional documentation.	N	N
GetByteMatchSet	This is AWS WAF Classic documentation.	N	N
GetChangeToken	This is AWS WAF Classic documentation.	Y	N
GetChangeTokenStatus	This is AWS WAF Classic documentation.	N	N
GetGeoMatchSet	This is AWS WAF Classic documentation.	N	N
GetIPSet	This is AWS WAF Classic documentation.	N	N
GetLoggingConfiguration	This is AWS WAF Classic documentation.	N	N
GetPermissionPolicy	This is AWS WAF Classic documentation.	N	N
GetRateBasedRule	This is AWS WAF Classic documentation.	N	N
GetRateBasedRuleManagedKeys	This is AWS WAF Classic documentation.	N	N
GetRegexMatchSet	This is AWS WAF Classic documentation.	N	N
GetRegexPatternSet	This is AWS WAF Classic documentation.	N	N
GetRule	This is AWS WAF Classic documentation.	N	N
GetRuleGroup	This is AWS WAF Classic documentation.	N	N
GetSampledRequests	This is AWS WAF Classic documentation.	N	N
GetSizeConstraintSet	This is AWS WAF Classic documentation.	N	N
GetSqlInjectionMatchSet	This is AWS WAF Classic documentation.	N	N
GetWebACL	This is AWS WAF Classic documentation.	N	N
GetWebACLForResource	This is AWS WAF Classic Regional documentation.	Y	N
GetXssMatchSet	This is AWS WAF Classic documentation.	N	N
ListActivatedRulesInRuleGroup	This is AWS WAF Classic documentation.	Y	N
ListByteMatchSets	This is AWS WAF Classic documentation.	Y	N
ListGeoMatchSets	This is AWS WAF Classic documentation.	Y	N
ListIPSets	This is AWS WAF Classic documentation.	Y	N
ListLoggingConfigurations	This is AWS WAF Classic documentation.	Y	N
ListRateBasedRules	This is AWS WAF Classic documentation.	Y	N
ListRegexMatchSets	This is AWS WAF Classic documentation.	Y	N
ListRegexPatternSets	This is AWS WAF Classic documentation.	Y	N
ListResourcesForWebACL	This is AWS WAF Classic Regional documentation.	N	N
ListRuleGroups	This is AWS WAF Classic documentation.	Y	N
ListRules	This is AWS WAF Classic documentation.	Y	N
ListSizeConstraintSets	This is AWS WAF Classic documentation.	Y	N
ListSqlInjectionMatchSets	This is AWS WAF Classic documentation.	Y	N
ListSubscribedRuleGroups	This is AWS WAF Classic documentation.	Y	N
ListTagsForResource	This is AWS WAF Classic documentation.	N	N
ListWebACLs	This is AWS WAF Classic documentation.	Y	N
ListXssMatchSets	This is AWS WAF Classic documentation.	Y	N
PutLoggingConfiguration	This is AWS WAF Classic documentation.	N	N
PutPermissionPolicy	This is AWS WAF Classic documentation.	N	N
TagResource	This is AWS WAF Classic documentation.	N	N
UntagResource	This is AWS WAF Classic documentation.	N	N
UpdateByteMatchSet	This is AWS WAF Classic documentation.	Y	N
UpdateGeoMatchSet	This is AWS WAF Classic documentation.	Y	N
UpdateIPSet	This is AWS WAF Classic documentation.	Y	N
UpdateRateBasedRule	This is AWS WAF Classic documentation.	Y	N
UpdateRegexMatchSet	This is AWS WAF Classic documentation.	Y	N
UpdateRegexPatternSet	This is AWS WAF Classic documentation.	Y	N
UpdateRule	This is AWS WAF Classic documentation.	Y	N
UpdateRuleGroup	This is AWS WAF Classic documentation.	Y	N
UpdateSizeConstraintSet	This is AWS WAF Classic documentation.	Y	N
UpdateSqlInjectionMatchSet	This is AWS WAF Classic documentation.	Y	N
UpdateWebACL	This is AWS WAF Classic documentation.	N	N
UpdateXssMatchSet	This is AWS WAF Classic documentation.	Y	N

any: AWS WAF Regional (Classic) (catch-all)

Service: waf-regional

Description

Catch-all entry for AWS WAF Regional (Classic) rules that match the service but not a specific eventName.

AssociateWebACL

Service: waf-regional

Description

This is AWS WAF Classic Regional documentation.

CreateByteMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "691e73d1-51b3-4df2-b5ea-50d15d51480a",
  "eventName": "CreateByteMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1b57ec54-1b1d-4715-9fbf-8f4731eb3bf0",
  "requestParameters": {
    "changeToken": "a0331cb8-73dc-4e25-b0c1-bebaa5287654",
    "name": "dwfix-bytematch"
  },
  "responseElements": {
    "byteMatchSet": {
      "byteMatchSetId": "01f6aa89-e0b7-4411-9bea-68ddc9236890",
      "byteMatchTuples": [],
      "name": "dwfix-bytematch"
    },
    "changeToken": "a0331cb8-73dc-4e25-b0c1-bebaa5287654"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateGeoMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "71ff1e33-7045-437e-8b0e-075df6b60a22",
  "eventName": "CreateGeoMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6ca8cc01-2b8b-491e-9e41-726400f410f0",
  "requestParameters": {
    "changeToken": "b59e8a8c-37e6-48b9-be80-c2b5e55aab19",
    "name": "dwfix-geo"
  },
  "responseElements": {
    "changeToken": "b59e8a8c-37e6-48b9-be80-c2b5e55aab19",
    "geoMatchSet": {
      "geoMatchConstraints": [],
      "geoMatchSetId": "76117527-1eb7-411b-ab4d-5366c4f5a8f9",
      "name": "dwfix-geo"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateIPSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "221bbd49-0524-4877-9d7b-c29c6bef1b1d",
  "eventName": "CreateIPSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "70d20044-37f5-4c00-8db3-8fad6fd804e1",
  "requestParameters": {
    "changeToken": "735fafb3-c456-4ba0-bcd0-3111fb75a314",
    "name": "dwfix-ipset"
  },
  "responseElements": {
    "changeToken": "735fafb3-c456-4ba0-bcd0-3111fb75a314",
    "iPSet": {
      "iPSetDescriptors": [],
      "iPSetId": "b34197eb-2379-4c45-98d1-bd741fb1cc67",
      "name": "dwfix-ipset"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRateBasedRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "48bcc6a8-f668-4c48-afd5-78cfa0f178ac",
  "eventName": "CreateRateBasedRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d1eba71d-4282-4815-a712-bb589e716f74",
  "requestParameters": {
    "changeToken": "2586a4b8-f23c-4cd7-884e-9863cb16bd1e",
    "metricName": "dwfixraterule",
    "name": "dwfix-raterule",
    "rateKey": "IP",
    "rateLimit": 2000
  },
  "responseElements": {
    "changeToken": "2586a4b8-f23c-4cd7-884e-9863cb16bd1e",
    "rule": {
      "matchPredicates": [],
      "metricName": "dwfixraterule",
      "name": "dwfix-raterule",
      "rateKey": "IP",
      "rateLimit": 2000,
      "ruleId": "eeade2ac-d8e1-4993-b1ed-a15d96bfd5d9"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRegexMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f6c22fb1-6012-41e5-8790-6722dbb6e3d3",
  "eventName": "CreateRegexMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "91366b98-8168-4816-ba5b-66ed9f637d3c",
  "requestParameters": {
    "changeToken": "4ad8a376-aa01-4e45-84a4-0b9685976afa",
    "name": "dwfix-regexmatch"
  },
  "responseElements": {
    "changeToken": "4ad8a376-aa01-4e45-84a4-0b9685976afa",
    "regexMatchSet": {
      "name": "dwfix-regexmatch",
      "regexMatchSetId": "203fa903-7267-493a-8cf9-8e9d0e0755a3",
      "regexMatchTuples": []
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRegexPatternSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "59caf963-1230-4cdb-833b-1af4843037f4",
  "eventName": "CreateRegexPatternSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1de5ba57-66bc-4052-be19-3e8638f3b6bb",
  "requestParameters": {
    "changeToken": "d54ebe54-31a9-4853-848a-e00010e02b5a",
    "name": "dwfix-regexpattern"
  },
  "responseElements": {
    "changeToken": "d54ebe54-31a9-4853-848a-e00010e02b5a",
    "regexPatternSet": {
      "name": "dwfix-regexpattern",
      "regexPatternSetId": "76836b36-0614-430f-bac8-7f2269aac990",
      "regexPatternStrings": []
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "264f90de-ae83-45a1-84a0-baa71e7efecb",
  "eventName": "CreateRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b2d18bb6-07af-4e5e-b6ec-6e50f8d19e66",
  "requestParameters": {
    "changeToken": "ebd9850b-6162-4bc1-9243-e7d90f1061e9",
    "metricName": "dwfixrule",
    "name": "dwfix-rule"
  },
  "responseElements": {
    "changeToken": "ebd9850b-6162-4bc1-9243-e7d90f1061e9",
    "rule": {
      "metricName": "dwfixrule",
      "name": "dwfix-rule",
      "predicates": [],
      "ruleId": "cca9dd3d-4279-4d10-a945-997033d367b2"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRuleGroup

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "da35b745-c921-4488-870e-95114c3af333",
  "eventName": "CreateRuleGroup",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cad4931b-3857-42cd-90df-f922d0025f5b",
  "requestParameters": {
    "changeToken": "a0f17f4c-6942-495f-986d-15fcda516e3d",
    "metricName": "dwfixrulegroup",
    "name": "dwfix-rulegroup"
  },
  "responseElements": {
    "changeToken": "a0f17f4c-6942-495f-986d-15fcda516e3d",
    "ruleGroup": {
      "metricName": "dwfixrulegroup",
      "name": "dwfix-rulegroup",
      "ruleGroupId": "417eac10-a020-4d08-8ee1-c9611677795a"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateSizeConstraintSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8dc95b48-36f1-4026-bc01-08fd7cb32ada",
  "eventName": "CreateSizeConstraintSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "73f2f4ee-f35c-46b8-a5fd-443b1a9fd8a7",
  "requestParameters": {
    "changeToken": "a6814f23-b168-476f-9d6f-a5c9035fc7ae",
    "name": "dwfix-sizeconstraint"
  },
  "responseElements": {
    "changeToken": "a6814f23-b168-476f-9d6f-a5c9035fc7ae",
    "sizeConstraintSet": {
      "name": "dwfix-sizeconstraint",
      "sizeConstraintSetId": "caee8145-f383-41af-b3f1-0736d58b00f9",
      "sizeConstraints": []
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateSqlInjectionMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "37942476-735a-43ff-af06-5e6e576f5f30",
  "eventName": "CreateSqlInjectionMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "361b22e9-f5d2-46e7-9b95-07debe3a476e",
  "requestParameters": {
    "changeToken": "dfa2b282-30cc-4668-9743-fc8c396bb7f5",
    "name": "dwfix-sqli"
  },
  "responseElements": {
    "changeToken": "dfa2b282-30cc-4668-9743-fc8c396bb7f5",
    "sqlInjectionMatchSet": {
      "name": "dwfix-sqli",
      "sqlInjectionMatchSetId": "01ab5edb-ca28-4a79-80b9-8eb9dffa8eda",
      "sqlInjectionMatchTuples": []
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateWebACL

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "errorCode": "WAFBadRequestException",
  "errorMessage": "AWS WAF Classic (v1) support will end on September 30, 2025. Effective May 1st, 2025, the creation of new WebACL v1 is no longer permitted.",
  "eventCategory": "Management",
  "eventID": "2385a8fe-60f0-4bbf-a1fc-db0372e2adc0",
  "eventName": "CreateWebACL",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "378e6ab3-941b-463c-a057-92516dfaa987",
  "requestParameters": {
    "changeToken": "b59e0fb2-3a50-4f6b-a886-a786f72a9104",
    "defaultAction": {
      "type": "ALLOW"
    },
    "metricName": "dwfixwebacl",
    "name": "dwfix-webacl"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateWebACLMigrationStack

Service: waf-regional

Description

Creates an AWS CloudFormation WAFV2 template for the specified web ACL in the specified Amazon S3 bucket.

CreateXssMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "db0e8280-2e2d-4226-8c97-601fdbd8539c",
  "eventName": "CreateXssMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:22Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5f300ad1-e0d4-43d0-b27e-c5306d9cfa0b",
  "requestParameters": {
    "changeToken": "3f5ecbee-7324-48b8-a03f-1c7543037355",
    "name": "dwfix-xss"
  },
  "responseElements": {
    "changeToken": "3f5ecbee-7324-48b8-a03f-1c7543037355",
    "xssMatchSet": {
      "name": "dwfix-xss",
      "xssMatchSetId": "8fac7b2f-a058-4ace-abbd-0026e23c4228",
      "xssMatchTuples": []
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteByteMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3d217299-240d-4ada-b751-b318e48e0ac5",
  "eventName": "DeleteByteMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "904fcfa2-80b6-401a-ae58-9a83dca1354f",
  "requestParameters": {
    "byteMatchSetId": "01f6aa89-e0b7-4411-9bea-68ddc9236890",
    "changeToken": "ee40e85e-b24a-4d50-90f9-d9d878637cc1"
  },
  "responseElements": {
    "changeToken": "ee40e85e-b24a-4d50-90f9-d9d878637cc1"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteGeoMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "917a617a-324f-43b1-be3b-50be093eac53",
  "eventName": "DeleteGeoMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b4286917-c6ff-4270-aff2-15a5a5a2f436",
  "requestParameters": {
    "changeToken": "c8bd6c3f-e914-4424-b95f-4a99a4707be4",
    "geoMatchSetId": "76117527-1eb7-411b-ab4d-5366c4f5a8f9"
  },
  "responseElements": {
    "changeToken": "c8bd6c3f-e914-4424-b95f-4a99a4707be4"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteIPSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4d5686c3-6653-487a-8367-9b7ff7a47296",
  "eventName": "DeleteIPSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6c1a7888-b702-4dea-86d4-63c2ac9c1539",
  "requestParameters": {
    "changeToken": "d8dd5b77-1284-49de-b9fe-040e28df1ee5",
    "iPSetId": "b34197eb-2379-4c45-98d1-bd741fb1cc67"
  },
  "responseElements": {
    "changeToken": "d8dd5b77-1284-49de-b9fe-040e28df1ee5"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteLoggingConfiguration

Service: waf-regional

Description

This is AWS WAF Classic documentation.

DeletePermissionPolicy

Service: waf-regional

Description

This is AWS WAF Classic documentation.

DeleteRateBasedRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9fd381f7-63ae-48ee-97fe-a87063d1c9c3",
  "eventName": "DeleteRateBasedRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "28aa0135-456b-4da3-9d7b-aea9c34b288d",
  "requestParameters": {
    "changeToken": "1eccc1da-eb1c-424d-a694-2eb41f722d79",
    "ruleId": "eeade2ac-d8e1-4993-b1ed-a15d96bfd5d9"
  },
  "responseElements": {
    "changeToken": "1eccc1da-eb1c-424d-a694-2eb41f722d79"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteRegexMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "34d29fe9-6298-4e78-8ac1-e02c1c906503",
  "eventName": "DeleteRegexMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "acaaf91c-b45e-467f-ae9c-f572e57844c6",
  "requestParameters": {
    "changeToken": "cd04a315-b177-4605-b42e-134586a6e434",
    "regexMatchSetId": "203fa903-7267-493a-8cf9-8e9d0e0755a3"
  },
  "responseElements": {
    "changeToken": "cd04a315-b177-4605-b42e-134586a6e434"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteRegexPatternSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "62c0531d-402f-475f-abaa-e499b37bddd2",
  "eventName": "DeleteRegexPatternSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:37Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e3e4f7b4-96eb-40ec-a18a-b7f59a34ce9b",
  "requestParameters": {
    "changeToken": "43a2f8f1-db9b-4c63-be58-12d8e01a7215",
    "regexPatternSetId": "76836b36-0614-430f-bac8-7f2269aac990"
  },
  "responseElements": {
    "changeToken": "43a2f8f1-db9b-4c63-be58-12d8e01a7215"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "74abd342-01aa-48f3-aa2a-609e83f005e5",
  "eventName": "DeleteRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "117620dd-9440-4fa8-bce8-5da1a824fa28",
  "requestParameters": {
    "changeToken": "6e63b64e-f4eb-4e42-a78e-40c348596ab4",
    "ruleId": "cca9dd3d-4279-4d10-a945-997033d367b2"
  },
  "responseElements": {
    "changeToken": "6e63b64e-f4eb-4e42-a78e-40c348596ab4"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS WAF Rule or Rule Group Deletion source medium: Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct application compromise.T1562, T1562.007↳ also matches DeleteRuleGroup

DeleteRuleGroup

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "bc8a3b8f-b072-4c9b-908c-906515502bee",
  "eventName": "DeleteRuleGroup",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9ab6b504-1f3f-46e5-8a8d-6a5d02568e4f",
  "requestParameters": {
    "changeToken": "402e7525-78be-4ac0-af34-66e0a57996e7",
    "ruleGroupId": "417eac10-a020-4d08-8ee1-c9611677795a"
  },
  "responseElements": {
    "changeToken": "402e7525-78be-4ac0-af34-66e0a57996e7"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS WAF Rule or Rule Group Deletion source medium: Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct application compromise.T1562, T1562.007↳ also matches DeleteRule

DeleteSizeConstraintSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "81339276-45c1-481b-8a2b-5aacc8619497",
  "eventName": "DeleteSizeConstraintSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d9c0609e-86be-4d17-ad71-9a5cd811c42e",
  "requestParameters": {
    "changeToken": "ad1ceea6-e4d1-4ae8-a57e-dae9bd16b76a",
    "sizeConstraintSetId": "caee8145-f383-41af-b3f1-0736d58b00f9"
  },
  "responseElements": {
    "changeToken": "ad1ceea6-e4d1-4ae8-a57e-dae9bd16b76a"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteSqlInjectionMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fb97bf47-77eb-47e0-bd69-bd56ff0f096d",
  "eventName": "DeleteSqlInjectionMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "217a763e-0340-4e44-be7f-b0d062d3efb9",
  "requestParameters": {
    "changeToken": "d79908c4-ed82-4579-8415-db6aa8fcf390",
    "sqlInjectionMatchSetId": "01ab5edb-ca28-4a79-80b9-8eb9dffa8eda"
  },
  "responseElements": {
    "changeToken": "d79908c4-ed82-4579-8415-db6aa8fcf390"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteWebACL

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS WAF Access Control List Deletion source medium: Identifies the deletion of an AWS Web Application Firewall (WAF) Web ACL. Web ACLs are the core enforcement objects in AWS WAF, defining which traffic is inspected, allowed, or blocked for protected applications. Deleting a Web ACL removes all associated rules, protections, and logging configurations. Adversaries who obtain sufficient privileges may delete a Web ACL to disable critical security controls, evade detection, or prepare for downstream attacks such as web-application compromise, data theft, or resource abuse. Because Web ACLs are rarely deleted outside of controlled maintenance or infrastructure updates, unexpected deletions may indicate potential defense evasion.T1562, T1562.007

DeleteXssMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "59d16c42-6116-413b-9ac3-9724e2a15839",
  "eventName": "DeleteXssMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7b60008f-f4d7-4cdd-9df7-8d30a384e3b2",
  "requestParameters": {
    "changeToken": "b0bfa43a-57de-4633-a848-f9a0bc361eaf",
    "xssMatchSetId": "8fac7b2f-a058-4ace-abbd-0026e23c4228"
  },
  "responseElements": {
    "changeToken": "b0bfa43a-57de-4633-a848-f9a0bc361eaf"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateWebACL

Service: waf-regional

Description

This is AWS WAF Classic Regional documentation.

GetByteMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetChangeToken

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:GetChangeToken on resource: arn:aws:waf-regional:us-east-1:811596193553:changetoken/*",
  "eventID": "2548b2e3-5772-455f-9417-a756e319cb7a",
  "eventName": "GetChangeToken",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "53c7d6ae-aec0-11e9-a531-35cb19b1796e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetChangeTokenStatus

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetGeoMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetIPSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetLoggingConfiguration

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetPermissionPolicy

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRateBasedRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRateBasedRuleManagedKeys

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRegexMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRegexPatternSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetRuleGroup

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetSampledRequests

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetSizeConstraintSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetSqlInjectionMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetWebACL

Service: waf-regional

Description

This is AWS WAF Classic documentation.

GetWebACLForResource

Service: waf-regional

Description

This is AWS WAF Classic Regional documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "eventCategory": "Management",
  "eventID": "b861aa18-9a70-437b-814e-42cafa92845e",
  "eventName": "GetWebACLForResource",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T18:46:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9d2dc479-2bc5-4af7-a208-60d432bcf21b",
  "requestParameters": {
    "resourceArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetXssMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

ListActivatedRulesInRuleGroup

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListActivatedRulesInRuleGroup on resource: arn:aws:waf-regional:us-east-1:811596193553:rulegroup/*",
  "eventID": "1fc47448-83cc-4832-86f9-fac8b40ab28f",
  "eventName": "ListActivatedRulesInRuleGroup",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-10-21T05:23:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "568cb23e-c3e7-4b2e-b5fe-175576f8765c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "250.214.135.110",
  "userAgent": "Boto3/1.9.210 Python/2.7.10 Darwin/18.7.0 Botocore/1.12.210",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListByteMatchSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListByteMatchSets on resource: arn:aws:waf-regional:us-east-1:811596193553:bytematchset/*",
  "eventID": "c517dae5-05fc-4845-8aaa-9d399379d114",
  "eventName": "ListByteMatchSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "514cc460-aec0-11e9-85c3-bd2ebe71b819",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListGeoMatchSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListGeoMatchSets on resource: arn:aws:waf-regional:us-east-1:811596193553:geomatchset/*",
  "eventID": "d6c29923-80c2-4837-823c-471c6835875e",
  "eventName": "ListGeoMatchSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "525f45c2-aec0-11e9-8e26-ffd483f9bb81",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListIPSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListIPSets on resource: arn:aws:waf-regional:us-east-1:811596193553:ipset/*",
  "eventID": "dbe172c3-7725-47db-8bd5-28daa60220c",
  "eventName": "ListIPSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "607431-aec0-11e9-8e26-ffd483f9bb81",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListLoggingConfigurations

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListLoggingConfigurations on resource: arn:aws:waf-regional:us-east-1:811596193553:webacl/*",
  "eventID": "5db6df85-18a2-4d4c-8d3e-d83f508e2ca6",
  "eventName": "ListLoggingConfigurations",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "51c3a21e-aec0-11e9-85c3-bd2ebe71b819",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRateBasedRules

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListRateBasedRules on resource: arn:aws:waf-regional:us-east-1:811596193553:ratebasedrule/*",
  "eventID": "7ee87559-30b3-40d5-afe1-c5bf9181c9c3",
  "eventName": "ListRateBasedRules",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-10-21T05:23:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "25b53a19-167e-4221-843a-afad8cde0b72",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "250.214.135.110",
  "userAgent": "Boto3/1.9.210 Python/2.7.10 Darwin/18.7.0 Botocore/1.12.210",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRegexMatchSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListRegexMatchSets on resource: arn:aws:waf-regional:us-east-1:811596193553:regexmatch/*",
  "eventID": "116395cd-0ea4-4908-b243-925fa724dca3",
  "eventName": "ListRegexMatchSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "536ae99f-aec0-11e9-85c3-bd2ebe71b819",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRegexPatternSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListRegexPatternSets on resource: arn:aws:waf-regional:us-east-1:811596193553:regexpatternset/*",
  "eventID": "5a3a5fe0-cdc4-4d57-b5d9-f52c80be5a9e",
  "eventName": "ListRegexPatternSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "523aa6ea-aec0-11e9-85c3-bd2ebe71b819",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListResourcesForWebACL

Service: waf-regional

Description

This is AWS WAF Classic Regional documentation.

ListRuleGroups

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: waf-regional:ListRuleGroups on resource: arn:aws:waf-regional:us-east-1:811596193553:rulegroup/*",
  "eventID": "59688-b060-405c-b088-66fbc125e00d",
  "eventName": "ListRuleGroups",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-10-19T23:49:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "1d15d777-e78f-42df-8e56-a1f341430e31a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "213.253.166.5",
  "userAgent": "Boto3/1.9.210 Python/2.7.10 Darwin/18.7.0 Botocore/1.12.210",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListRules

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListRules on resource: arn:aws:waf-regional:us-east-1:811596193553:rule/*",
  "eventID": "976ee7af-1db6-4342-81b6-ec3e6209f442",
  "eventName": "ListRules",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "33757cd1-aec0-11e9-a531-35cb19b1796e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListSizeConstraintSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListSizeConstraintSets on resource: arn:aws:waf-regional:us-east-1:811596193553:sizeconstraintset/*",
  "eventID": "43b5407b-b194-4d2c-bc64-6b86a474e0b1",
  "eventName": "ListSizeConstraintSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "51ec5fab-aec0-11e9-a531-35cb19b1796e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListSqlInjectionMatchSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListSqlInjectionMatchSets on resource: arn:aws:waf-regional:us-east-1:811596193553:sqlinjectionset/*",
  "eventID": "6b23c07b-3620-499c-8bda-d848af551154",
  "eventName": "ListSqlInjectionMatchSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "50c4cf6d-aec0-11e9-8e26-ffd483f9bb81",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListSubscribedRuleGroups

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListSubscribedRuleGroups on resource: arn:aws:waf-regional:us-east-1:811596193553:rulegroup/*",
  "eventID": "e2a792735-08e6-406e-a2e6-812cf07e5fbf",
  "eventName": "ListSubscribedRuleGroups",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "50c45a71-aec0-11e9-85c3-bd2ebe71b819",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListTagsForResource

Service: waf-regional

Description

This is AWS WAF Classic documentation.

ListWebACLs

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "ap-southeast-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::731544447609:user/cloudsploit is not authorized to perform: waf-regional:ListWebACLs on resource: arn:aws:waf-regional:ap-southeast-2:731544447609:webacl/*",
  "eventCategory": "Management",
  "eventID": "88138ecf-aa95-4965-8088-36b1145c00ca",
  "eventName": "ListWebACLs",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2021-04-13T11:35:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "731544447609",
  "requestID": "ba9f2fe4-f5be-4bf7-8159-ed5564bf2e70",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "34.12.134.20",
  "userAgent": "aws-sdk-nodejs/2.885.0 linux/v14.16.1 callback",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLGBSBSMH2",
    "accountId": "731544447609",
    "arn": "arn:aws:iam::731544447609:user/cloudsploit",
    "principalId": "AIDAYTOGP2RLMDEPWZWMJ",
    "type": "IAMUser",
    "userName": "cloudsploit"
  }
}

References #

Sample log: splunk/attack_data

ListXssMatchSets

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: waf-regional:ListXssMatchSets on resource: arn:aws:waf-regional:us-east-1:811596193553:xssmatchset/*",
  "eventID": "a9a0b579-89d8-4c42-aed9-f674ceb684c4",
  "eventName": "ListXssMatchSets",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2019-07-25T09:41:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "519dca70-aec0-11e9-a531-35cb19b1796e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

PutLoggingConfiguration

Service: waf-regional

Description

This is AWS WAF Classic documentation.

PutPermissionPolicy

Service: waf-regional

Description

This is AWS WAF Classic documentation.

TagResource

Service: waf-regional

Description

This is AWS WAF Classic documentation.

UntagResource

Service: waf-regional

Description

This is AWS WAF Classic documentation.

UpdateByteMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8ddb3edf-77a0-44b2-98aa-797228f3757d",
  "eventName": "UpdateByteMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:20Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f6337f90-6f61-4f42-af94-aa69090cac12",
  "requestParameters": {
    "byteMatchSetId": "01f6aa89-e0b7-4411-9bea-68ddc9236890",
    "changeToken": "4f78cd97-f78b-4770-9582-28c1c69c5f1b",
    "updates": [
      {
        "action": "INSERT",
        "byteMatchTuple": {
          "fieldToMatch": {
            "type": "URI"
          },
          "positionalConstraint": "STARTS_WITH",
          "targetString": {
            "address": 12,
            "bigEndian": true,
            "capacity": 6,
            "hb": [
              47,
              97,
              100,
              109,
              105,
              110
            ],
            "isReadOnly": false,
            "limit": 6,
            "mark": -1,
            "nativeByteOrder": false,
            "offset": 0,
            "position": 0
          },
          "textTransformation": "NONE"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "4f78cd97-f78b-4770-9582-28c1c69c5f1b"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateGeoMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6b778127-aa5c-4f1a-bf5f-6b46c0d6bcfd",
  "eventName": "UpdateGeoMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "420f4373-1126-42ff-9623-25c54861106f",
  "requestParameters": {
    "changeToken": "001ba2c3-fc1b-4b2f-b5eb-f2871d2c0444",
    "geoMatchSetId": "76117527-1eb7-411b-ab4d-5366c4f5a8f9",
    "updates": [
      {
        "action": "INSERT",
        "geoMatchConstraint": {
          "type": "Country",
          "value": "CN"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "001ba2c3-fc1b-4b2f-b5eb-f2871d2c0444"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateIPSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "6f6d6f3b-cca6-4e0a-ac13-80feb8804ee1",
  "eventName": "UpdateIPSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "2da45f83-7a14-4f1d-ae26-24b4655b1e3e",
  "requestParameters": {
    "changeToken": "3e5837bb-f410-4353-94ab-3bbe714c4969",
    "iPSetId": "b34197eb-2379-4c45-98d1-bd741fb1cc67",
    "updates": [
      {
        "action": "INSERT",
        "iPSetDescriptor": {
          "type": "IPV4",
          "value": "192.0.2.1/32"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "3e5837bb-f410-4353-94ab-3bbe714c4969"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRateBasedRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "222845b1-0cd3-4b61-8c4e-adf029a5748f",
  "eventName": "UpdateRateBasedRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "419bc333-7819-48ff-a884-712c2100e5ea",
  "requestParameters": {
    "changeToken": "8c64f705-a6d8-4e6d-8eb5-7574f90ea92d",
    "rateLimit": 5000,
    "ruleId": "eeade2ac-d8e1-4993-b1ed-a15d96bfd5d9",
    "updates": []
  },
  "responseElements": {
    "changeToken": "8c64f705-a6d8-4e6d-8eb5-7574f90ea92d"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRegexMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "cf59cbc7-a31f-45d3-80a3-da30746c10fa",
  "eventName": "UpdateRegexMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d031f1a0-ba0f-4b08-99f3-966968877a6b",
  "requestParameters": {
    "changeToken": "8bb2dc6c-2f9c-4f3b-8651-0cf494412194",
    "regexMatchSetId": "203fa903-7267-493a-8cf9-8e9d0e0755a3",
    "updates": [
      {
        "action": "INSERT",
        "regexMatchTuple": {
          "fieldToMatch": {
            "data": "User-Agent",
            "type": "HEADER"
          },
          "regexPatternSetId": "76836b36-0614-430f-bac8-7f2269aac990",
          "textTransformation": "LOWERCASE"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "8bb2dc6c-2f9c-4f3b-8651-0cf494412194"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRegexPatternSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f186df2c-a19d-4d9f-8417-d6da8c99bb38",
  "eventName": "UpdateRegexPatternSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1d62b78f-1cc8-4bf4-b06d-7e636bf59419",
  "requestParameters": {
    "changeToken": "c5055d5a-9a7f-4d7b-8d4b-f6024967124b",
    "regexPatternSetId": "76836b36-0614-430f-bac8-7f2269aac990",
    "updates": [
      {
        "action": "INSERT",
        "regexPatternString": "badbot"
      }
    ]
  },
  "responseElements": {
    "changeToken": "c5055d5a-9a7f-4d7b-8d4b-f6024967124b"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRule

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "30026887-92d0-4a26-9fb2-fbb5816dc89e",
  "eventName": "UpdateRule",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1715f80c-ca16-4f11-a3bf-16aa042eb8ae",
  "requestParameters": {
    "changeToken": "d16ceb50-6bea-4a85-be87-b6c093147cfc",
    "ruleId": "cca9dd3d-4279-4d10-a945-997033d367b2",
    "updates": [
      {
        "action": "INSERT",
        "predicate": {
          "dataId": "b34197eb-2379-4c45-98d1-bd741fb1cc67",
          "negated": false,
          "type": "IPMatch"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "d16ceb50-6bea-4a85-be87-b6c093147cfc"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRuleGroup

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "09f15f5f-c32b-489c-94e9-8a5ffafbc083",
  "eventName": "UpdateRuleGroup",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9f6077db-e577-4a00-81bf-16b963b33b97",
  "requestParameters": {
    "changeToken": "913ad7aa-b70d-45ad-98a6-e1b250a3f93a",
    "ruleGroupId": "417eac10-a020-4d08-8ee1-c9611677795a",
    "updates": [
      {
        "action": "INSERT",
        "activatedRule": {
          "action": {
            "type": "BLOCK"
          },
          "priority": 1,
          "ruleId": "cca9dd3d-4279-4d10-a945-997033d367b2",
          "type": "REGULAR"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "913ad7aa-b70d-45ad-98a6-e1b250a3f93a"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateSizeConstraintSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "070b56af-7264-47bd-8535-0a580dbf02a1",
  "eventName": "UpdateSizeConstraintSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "68d00c39-bf68-4185-aa1e-f770a583dbd1",
  "requestParameters": {
    "changeToken": "bed23bc8-8eb3-4b1b-a51d-cf2e882f83aa",
    "sizeConstraintSetId": "caee8145-f383-41af-b3f1-0736d58b00f9",
    "updates": [
      {
        "action": "INSERT",
        "sizeConstraint": {
          "comparisonOperator": "GT",
          "fieldToMatch": {
            "type": "BODY"
          },
          "size": 8192,
          "textTransformation": "NONE"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "bed23bc8-8eb3-4b1b-a51d-cf2e882f83aa"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateSqlInjectionMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "85c039d4-da70-4a37-8f15-acb66f14b53e",
  "eventName": "UpdateSqlInjectionMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f5fda2fd-d007-49ba-b2e1-c1d58688dd21",
  "requestParameters": {
    "changeToken": "85227e2b-e65a-4993-809a-2fadcc1e037c",
    "sqlInjectionMatchSetId": "01ab5edb-ca28-4a79-80b9-8eb9dffa8eda",
    "updates": [
      {
        "action": "INSERT",
        "sqlInjectionMatchTuple": {
          "fieldToMatch": {
            "type": "QUERY_STRING"
          },
          "textTransformation": "URL_DECODE"
        }
      }
    ]
  },
  "responseElements": {
    "changeToken": "85227e2b-e65a-4993-809a-2fadcc1e037c"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateWebACL

Service: waf-regional

Description

This is AWS WAF Classic documentation.

UpdateXssMatchSet

Service: waf-regional

Description

This is AWS WAF Classic documentation.

Example CloudTrail Event #

{
  "apiVersion": "2015-08-24",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "89b60226-e29d-40d6-a626-0b73cf976480",
  "eventName": "UpdateXssMatchSet",
  "eventSource": "waf-regional.amazonaws.com",
  "eventTime": "2026-06-29T21:02:23Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "35892bad-2531-4e01-ae44-909e09feb2f9",
  "requestParameters": {
    "changeToken": "7753e38b-fc34-43f6-950e-0c27ca00747d",
    "updates": [
      {
        "action": "INSERT",
        "xssMatchTuple": {
          "fieldToMatch": {
            "type": "BODY"
          },
          "textTransformation": "HTML_ENTITY_DECODE"
        }
      }
    ],
    "xssMatchSetId": "8fac7b2f-a058-4ace-abbd-0026e23c4228"
  },
  "responseElements": {
    "changeToken": "7753e38b-fc34-43f6-950e-0c27ca00747d"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "waf-regional.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

AWS WAF Regional (Classic)

any: AWS WAF Regional (Classic) (catch-all)

Description

AssociateWebACL

Description

CreateByteMatchSet

Description

Example CloudTrail Event #

CreateGeoMatchSet

Description

Example CloudTrail Event #

CreateIPSet

Description

Example CloudTrail Event #

CreateRateBasedRule

Description

Example CloudTrail Event #

CreateRegexMatchSet

Description

Example CloudTrail Event #

CreateRegexPatternSet

Description

Example CloudTrail Event #

CreateRule

Description

Example CloudTrail Event #

CreateRuleGroup

Description

Example CloudTrail Event #

CreateSizeConstraintSet

Description

Example CloudTrail Event #

CreateSqlInjectionMatchSet

Description

Example CloudTrail Event #

CreateWebACL

Description

Example CloudTrail Event #

CreateWebACLMigrationStack

Description

CreateXssMatchSet

Description

Example CloudTrail Event #

DeleteByteMatchSet

Description

Example CloudTrail Event #

DeleteGeoMatchSet

Description

Example CloudTrail Event #

DeleteIPSet

Description

Example CloudTrail Event #

DeleteLoggingConfiguration

Description

DeletePermissionPolicy

Description

DeleteRateBasedRule

Description

Example CloudTrail Event #

DeleteRegexMatchSet

Description

Example CloudTrail Event #

DeleteRegexPatternSet

Description

Example CloudTrail Event #

DeleteRule

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

DeleteRuleGroup

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

DeleteSizeConstraintSet

Description

Example CloudTrail Event #