AWS waf documentation change
Summary
Added new bot control labels and improved XSS detection signatures in managed rule groups
Security assessment
Enhances security documentation by adding new bot identification capabilities and improved XSS protections, but no explicit vulnerability fix mentioned
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index 9cc1d792d..dd60d7933 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -28,0 +29,28 @@ Rule group and rules | Description | Date +[AWS WAF Bot Control rule group](./aws-managed-rule-groups-bot.html) New labels: + + * Search engine bots: + * `awswaf:managed:aws:bot-control:bot:name:evensi` + * `awswaf:managed:aws:bot-control:bot:name:yisouspider` + * AI bots: + * `awswaf:managed:aws:bot-control:bot:name:searchbot` + * `awswaf:managed:aws:bot-control:bot:name:nova_act` + * Organization labels for AI bots: + * `awswaf:managed:aws:bot-control:bot:organization:openai` + * `awswaf:managed:aws:bot-control:bot:organization:marfeel` + * `awswaf:managed:aws:bot-control:bot:organization:facebook` + * `awswaf:managed:aws:bot-control:bot:organization:metaexternalagent` + * `awswaf:managed:aws:bot-control:bot:organization:amazon` + * Content fetcher bots: + * `awswaf:managed:aws:bot-control:bot:name:google_cloud_vertex_bot` + * Cloud service provider signals: + * `awswaf:managed:aws:bot-control:signal:cloud_service_provider:alibaba` + +| Released static version 3.2 of this rule group. Added the listed new labels. | 2025-05-29 +[Core rule set (CRS) managed rule group](./aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs) + + * `CrossSiteScripting_BODY` + * `CrossSiteScripting_COOKIE` + * `CrossSiteScripting_QUERYARGUMENTS` + * `CrossSiteScripting_URIPATH` + +| Released static version 1.17 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-03-03