AWS waf medium security documentation change
Summary
Added new Bot Control rules (CategoryPagePreview/CategoryWebhooks) and improved detection logic in version 5.0. Emphasizes reduced false positives and more accurate bot classification.
Security assessment
Directly addresses security controls by improving WAF's ability to detect malicious bots. The specific mention of reduced over-classification indicates security-related enhancements to prevent abuse.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index 5e77f6fc6..3c48dd577 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -20,0 +21,6 @@ Rule group and rules | Description | Date +[AWS WAF Bot Control rule group](./aws-managed-rule-groups-bot.html) New rules: + + * `CategoryPagePreview` + * `CategoryWebhooks` + +| Released static version 5.0 of this rule group. Added 400+ new bots across multiple categories, including two new bot categories with their respective rules: Page Preview and Webhooks. **Key Improvements** Improved accuracy of bot detection signals and generic bot pattern matching, resulting in more precise traffic classification. This update changes how the managed rule group prioritizes bot detection. Specific unverified bot patterns are now evaluated before generic patterns and detection signals. This means that requests are more likely to be classified based on their most specific characteristics rather than generic indicators. **What this means for your traffic:** Generic bot pattern will now match less frequently. These patterns only apply when no more specific bot rule has already identified the traffic. This reduces over-classification and ensures that requests are labeled with the most accurate bot identification available. Detection signals such as indicators that a request originates from a cloud service provider, known bot data center, or uses a non-browser user agent, are now applied after bot identification rules. This ensures that specific bot classifications take precedence over generic traffic signals. **Impact:** You may see fewer labels for generic bot patterns in your traffic logs, as requests are now more accurately classified by specific bot rules. This provides clearer insight into the actual nature of your automated traffic and reduces noise from overly broad pattern matching. Unverified bot classifications will be more prominent and accurate, helping you better understand and manage automated requests to your applications. **Note:** This version includes the `awswaf:managed:aws:bot-control:bot:web_bot_auth` labels and rules updates from Version_4.0, but the `Web Bot Auth` functionality is still only available in CloudFront. | 2026-02-25