AWS WAF Managed Rules for MCP Servers

WebACL Capacity Units (WCU) budget

Every WAF rule consumes Web ACL Capacity Units (WCU). A WebACL has a default maximum of 5,000 WCU. AWS Managed Rule Groups consume a fixed WCU allocation regardless of how many rules they contain.

Running all three free managed rule groups plus two custom rate rules totals ~945 WCU — well within the 5,000 cap and leaving budget for custom rules.

CommonRuleSet: which rules to exclude for MCP

The AWSManagedRulesCommonRuleSet contains 28 rules covering XSS, SQLi, path traversal, size restrictions, and remote file inclusion. Most rules are safe for MCP servers, but three create false positives:

// CDK: CommonRuleSet with MCP-specific exclusions
const commonRuleSet: wafv2.CfnWebACL.RuleProperty = {
  name: "AWSCommonRules",
  priority: 10,
  // overrideAction: { count: {} },    // use during rollout; switch to none: {} after baselining
  overrideAction: { none: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "AWSCommonRules",
    sampledRequestsEnabled: true,
  },
  statement: {
    managedRuleGroupStatement: {
      vendorName: "AWS",
      name: "AWSManagedRulesCommonRuleSet",
      excludedRules: [
        // These three rules cause false positives on MCP JSON-RPC payloads
        { name: "SizeRestrictions_BODY" },       // blocks tool calls with large context
        { name: "CrossSiteScripting_BODY" },     // blocks HTML-content tool arguments
        { name: "GenericRFI_BODY" },             // blocks URL-value tool arguments
      ],
      // Optional: pin to a specific version to avoid rule updates changing behavior
      // managedRuleGroupConfigs and version fields available in newer CDK versions
    },
  },
};

KnownBadInputsRuleSet: safe for MCP with no exclusions

The AWSManagedRulesKnownBadInputsRuleSet blocks exploitation attempts for specific CVEs and known bad input patterns: Log4j JNDI injection (${jndi:), SSRF payloads, and path traversal sequences. None of these patterns appear in normal MCP JSON-RPC traffic, making this rule group safe to attach without exclusions.

// CDK: KnownBadInputsRuleSet — no exclusions needed for MCP
const knownBadInputs: wafv2.CfnWebACL.RuleProperty = {
  name: "KnownBadInputs",
  priority: 11,
  overrideAction: { none: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "KnownBadInputs",
    sampledRequestsEnabled: true,
  },
  statement: {
    managedRuleGroupStatement: {
      vendorName: "AWS",
      name: "AWSManagedRulesKnownBadInputsRuleSet",
      // No excludedRules needed — these patterns don't appear in valid MCP traffic
    },
  },
};

Rules in this set that are particularly relevant to MCP servers:

IP Reputation List

The AWSManagedRulesAmazonIpReputationList is AWS's own threat intelligence feed of IPs associated with botnets, malware C2, and scanning activity. It costs 25 WCU and is free. Attach it at the highest priority (lowest priority number) so known-bad IPs are blocked before consuming capacity in other rule evaluations.

// CDK: IP Reputation List — attach at priority 5 (before all other rules)
const ipReputationList: wafv2.CfnWebACL.RuleProperty = {
  name: "AWSIpReputationList",
  priority: 5,
  overrideAction: { none: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "AWSIpReputationList",
    sampledRequestsEnabled: true,
  },
  statement: {
    managedRuleGroupStatement: {
      vendorName: "AWS",
      name: "AWSManagedRulesAmazonIpReputationList",
    },
  },
};

Complete WebACL with all three managed rule groups

// CDK: Complete WebACL for MCP server with three free managed rule groups
import * as wafv2 from "aws-cdk-lib/aws-wafv2";

const webAcl = new wafv2.CfnWebACL(this, "McpWebAcl", {
  scope: "REGIONAL",    // CLOUDFRONT in us-east-1 for CloudFront-fronted servers
  defaultAction: { allow: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "McpWebAclMetrics",
    sampledRequestsEnabled: true,
  },
  rules: [
    // Priority 1: Block known-bad IPs immediately (25 WCU)
    {
      name: "AWSIpReputationList",
      priority: 1,
      overrideAction: { none: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "IpReputation", sampledRequestsEnabled: true },
      statement: {
        managedRuleGroupStatement: {
          vendorName: "AWS",
          name: "AWSManagedRulesAmazonIpReputationList",
        },
      },
    },
    // Priority 2: Rate limit POST requests (protects against tool-call abuse)
    {
      name: "McpPostRateLimit",
      priority: 2,
      action: { block: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "McpPostRateLimit", sampledRequestsEnabled: true },
      statement: {
        rateBasedStatement: {
          limit: 1000,
          aggregateKeyType: "IP",
          scopeDownStatement: {
            andStatement: {
              statements: [
                { byteMatchStatement: { fieldToMatch: { uriPath: {} }, searchString: "/mcp", positionalConstraint: "STARTS_WITH", textTransformations: [{ priority: 0, type: "LOWERCASE" }] } },
                { byteMatchStatement: { fieldToMatch: { method: {} }, searchString: "POST", positionalConstraint: "EXACTLY", textTransformations: [{ priority: 0, type: "UPPERCASE" }] } },
              ],
            },
          },
        },
      },
    },
    // Priority 10: Known bad inputs (200 WCU) — Log4j, SSRF, path traversal
    {
      name: "KnownBadInputs",
      priority: 10,
      overrideAction: { none: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "KnownBadInputs", sampledRequestsEnabled: true },
      statement: {
        managedRuleGroupStatement: {
          vendorName: "AWS",
          name: "AWSManagedRulesKnownBadInputsRuleSet",
        },
      },
    },
    // Priority 20: Common rule set with MCP exclusions (700 WCU)
    {
      name: "AWSCommonRules",
      priority: 20,
      overrideAction: { none: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "AWSCommonRules", sampledRequestsEnabled: true },
      statement: {
        managedRuleGroupStatement: {
          vendorName: "AWS",
          name: "AWSManagedRulesCommonRuleSet",
          excludedRules: [
            { name: "SizeRestrictions_BODY" },
            { name: "CrossSiteScripting_BODY" },
            { name: "GenericRFI_BODY" },
          ],
        },
      },
    },
  ],
  // Total WCU: 25 + ~20 (rate rule) + 200 + 700 = ~945 / 5000 cap
});

Monitoring managed rule false positives

Even with the exclusions above, monitor for unexpected blocks during the first week in production. The CloudWatch metric BlockedRequests per rule name identifies which managed rule is triggering.

# CLI: List which managed rule sub-rules are triggering (past 24 hours)
aws cloudwatch get-metric-statistics \
  --namespace AWS/WAFV2 \
  --metric-name BlockedRequests \
  --dimensions Name=WebACL,Value=McpWebAcl Name=Region,Value=us-east-1 Name=Rule,Value=AWSCommonRules \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 3600 \
  --statistics Sum \
  --output table

# For sub-rule detail, query WAF logs in Athena:
-- SELECT terminatingruleid, terminatingrulematchdetails, COUNT(*) as count
-- FROM waf_logs
-- WHERE webaclname = 'McpWebAcl'
--   AND action = 'BLOCK'
--   AND terminatingruleid LIKE 'AWS%'
-- GROUP BY terminatingruleid, terminatingrulematchdetails
-- ORDER BY count DESC

Common failure modes