AWS Security ChangesHomeSearch

AWS cli documentation change

Service: cli · 2025-08-25 · Documentation low

File: cli/latest/reference/wafv2/create-rule-group.md

Summary

Updated documentation to clarify behavior differences between managed and customer-owned rule groups when invalid rule names are used in overrides. Added details about silent ignoring in managed groups vs update failures in customer-owned groups.

Security assessment

The change clarifies security-relevant behavior (how invalid configurations are handled) but does not indicate a specific security vulnerability being patched. It improves awareness of potential misconfigurations that could lead to unintended security posture (e.g., overrides not being applied in managed groups without warning).

Diff

diff --git a/cli/latest/reference/wafv2/create-rule-group.md b/cli/latest/reference/wafv2/create-rule-group.md
index d3fab54b9..498f2d0b8 100644
--- a//cli/latest/reference/wafv2/create-rule-group.md
+++ b//cli/latest/reference/wafv2/create-rule-group.md
@@ -15 +15 @@
-  * [AWS CLI 2.28.15 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.16 Command Reference](../../index.html) »
@@ -1800 +1800 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -1810 +1810 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -4129 +4129 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -4139 +4139 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -5733 +5733 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -5743 +5743 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -8216 +8216 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -8226 +8226 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -9820 +9820 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -9830 +9830 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -12082 +12082 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -12092 +12092 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -13686 +13686 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -13696 +13696 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -15942 +15942 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -15952 +15952 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -17546 +17546 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -17556 +17556 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -19840 +19840 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -19850 +19850 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -21444 +21444 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -21454 +21454 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -22682 +22682 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -22692 +22692 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/wafv2-
->>>>>>> Take care to verify the rule names in your overrides. If you provide a rule name that doesn’t match the name of any rule in the rule group, WAF doesn’t return an error and doesn’t apply the override setting.
+>>>>>>> Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn’t exactly match the case-sensitive name of an existing rule in the rule group.
@@ -29202 +29202 @@ Summary -> (structure)
-  * [AWS CLI 2.28.15 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.16 Command Reference](../../index.html) »