Okay, I've been setting up AWS WAF for a couple of project teams now, and something keeps tripping me up. When you create a new rule group or a managed rule group, the default action is set to **Allow**. Every single time. This feels backwards to me.
My mental model from tools like Jira or Asana (or even physical kanban) is that you start with a clear, safe baseline and then make explicit exceptions. If I'm filtering traffic, shouldn't my default stance be to block everything, and then only allow what I know is safe and necessary? Starting with "Allow" means I might accidentally let something nasty through because I forgot to add a "Block" rule at the end.
Here’s my typical scramble:
* Create a managed rule group (like the AWS Managed Rules).
* Dive into the rule overrides to set things to `Block`.
* Realize the top-level default is still `Allow` 😅.
* Frantically set the rule group's action override to `Block`.
Wouldn't it be more secure—and intuitive—if the default was `Block`? You'd then consciously add `Allow` rules for your specific app needs. It’s like starting a project with a "Definition of Done" before you write the first story.
Or am I overthinking this? Maybe there's a workflow reason for the `Allow` default that I'm missing? Keen to hear how others handle this. Do you have a checklist or a saved template to flip this around quickly?