AWS waf medium security documentation change
Summary
Added changelog entries for two AWS Managed Rule Groups (SQL database and Windows OS) detailing new rule versions, added rules, and enhanced detection logic with new text transformations.
Security assessment
The change documents updates to managed security rule groups, specifically the addition of new rules (`SQLiExtendedPatterns_HEADER`, `SQLiExtendedPatterns_URIPATH`, `WindowsShellCommands_URIPATH`) and enhancements to detection logic (e.g., adding `REPLACE_COMMENTS` and `JS_DECODE` transformations). These updates are direct responses to evolving web application threats (SQL injection, OS command injection). The inclusion of future dates (2026-04-29, 2026-04-28) suggests these are planned security improvements to address specific attack vectors, indicating proactive security hardening.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index 33fb28195..cafa4965f 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -22,0 +23,21 @@ Rule group and rules | Description | Date +[SQL database managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-sql-db) + + * `SQLi_COOKIE` + * `SQLi_URIPATH` + * `SQLi_QUERYARGUMENTS` + * `SQLi_BODY` + * `SQLiExtendedPatterns_QUERYARGUMENTS` + * `SQLiExtendedPatterns_BODY` + * `SQLiExtendedPatterns_HEADER` + * `SQLiExtendedPatterns_URIPATH` + +| Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. | 2026-04-29 +[Windows operating system managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-windows-os) + + * `WindowsShellCommands_HEADER` + * `WindowsShellCommands_COOKIE` + * `WindowsShellCommands_URIPATH` + * `WindowsShellCommands_BODY` + * `WindowsShellCommands_QUERYARGUMENTS` + +| Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28