AWS waf documentation change

Service: waf · 2025-12-10 · Documentation medium

File: waf/latest/developerguide/waf-bot-control.md

Summary

Added section on Web Bot Authentication for AI agents and updated documentation link

Security assessment

Introduces new cryptographic verification method (WBA) for bot authentication, enhancing security against false positives. No evidence of addressing existing vulnerabilities.

Diff

diff --git a/waf/latest/developerguide/waf-bot-control.md b/waf/latest/developerguide/waf-bot-control.md
index 77b434862..7e27a3f4d 100644
--- a//waf/latest/developerguide/waf-bot-control.md
+++ b//waf/latest/developerguide/waf-bot-control.md
@@ -4,0 +5,2 @@
+Web bot authentication for AI agents
+
@@ -7 +9 @@
-You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see [Working with the updated console experience](./working-with-console.html). 
+You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see [Working with the console](https://docs.aws.amazon.com/waf/latest/developerguide/working-with-console.html). 
@@ -25,2 +26,0 @@ The Bot Control rule group also provides a targeted protection level that adds d
-For more information about the Bot Control managed rule group, see [AWS WAF Bot Control rule group](./aws-managed-rule-groups-bot.html). 
-
@@ -30,0 +31,17 @@ You can also use AWS Firewall Manager AWS WAF policies to deploy the Bot Control
+For more information about the Bot Control managed rule group, see [AWS WAF Bot Control rule group](./aws-managed-rule-groups-bot.html). 
+
+## Web bot authentication for AI agents
+
+AWS WAF Bot Control now supports Web Bot Authentication (WBA) as a cryptographic verification method for bots and AI agents accessing your CloudFront distributions. This feature enables legitimate AI crawlers and agents to prove their identity without requiring traditional challenge-response mechanisms.
+
+Version requirement: `AWSManagedRulesBotControlRuleSet` Version_4.0 or later. (The static version must be explicitly selected.) For detailed label taxonomy and rule behavior, see: 
+
+  * [AWS WAF Bot Control rule group](./aws-managed-rule-groups-bot.html)
+
+  * [Web request labeling in AWS WAF](./waf-labels.html)
+
+  * [AWS Managed Rules changelog](./aws-managed-rule-groups-changelog.html)
+
+
+
+