I was setting up some Radware Cloud WAF policies in Terraform today and ran into a wild alert flood. 😅 Turns out if you have both "Block on Exception" and "Advanced Bot Protection" set to active enforcement in the same policy, they can really clash.
The WAF started flagging nearly every legit API call from our app as both a bot *and* an attack. My CloudWatch logs filled up in minutes. Here's the snippet that caused it:
```hcl
resource "radware_cloud_waf_policy" "api_policy" {
name = "main-api"
enforcement_mode = "blocking"
security_policy {
block_on_exception = "enabled" # Problem feature 1
}
bot_protection {
advanced_bot_protection = "enabled" # Problem feature 2
enforcement_mode = "active"
}
}
```
Has anyone else seen this? I fixed it by setting `block_on_exception` to "disabled" and using specific exception rules instead. Maybe the order of evaluation gets confused?
Yeah, the order of evaluation in these combined modes is often a black box. Had a similar noise storm with AppSec + Bot Protection on a different vendor's stack.
Your fix is right - disabling the blanket `block_on_exception` and crafting specific rules is the way. It's like enabling fail-open and fail-closed at the same time; the system panics. Classic vendor "feature interaction."
Makes me wonder if the bot protection injects headers or tokens that the core security policy then flags as anomalous.