How do I optimize a regex pattern set?

Resolution

There is a default maximum regex pattern set for each AWS Region quota in AWS WAF and in AWS WAF Classic. These quotas can't be changed. When you reach your quota, you must expand or consolidate your existing regex pattern sets.

Reuse regex pattern sets

When possible, reuse regex pattern sets within multiple web access control list (web ACL) rules. When you update the referenced regex pattern set, AWS WAF automatically updates all the rules that reference it.

Update existing regex pattern sets

Use AWS Command Line Interface (AWS CLI) to update your regex pattern set

To update your regex pattern set, run update-regex-pattern-set.

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Use the AWS WAF console to update your regex pattern set

1. Open the AWS WAF console.
2. In the navigation pane, choose Regex pattern sets.
3. Select your regex pattern set.
4. To add a new pattern, choose Add Regex patterns.
5. To delete an existing pattern, select the pattern, and then choose Delete.

Update your existing regex pattern sets to use multiple patterns in a single regex pattern set. To use the character count more efficiently, use the OR logical "|" to add multiple patterns to a single pattern.

Note: AWS WAF has quotas for maximum characters in each regex pattern. These differ from the AWS WAF Classic quotas.

For example, instead of this:

#--------------------------
# REGEX_Pattern_Set_A
#--------------------------
REGEX_PATTERN_1
REGEX_PATTERN_2
REGEX_PATTERN_3
REGEX_PATTERN_4
REGEX_PATTERN_5
REGEX_PATTERN_6
REGEX_PATTERN_7
REGEX_PATTERN_8
REGEX_PATTERN_9
REGEX_PATTERN_10

Do this:

#--------------------------
#REGEX_Pattern_Set_A
#--------------------------
REGEX_PATTERN_1
REGEX_PATTERN_2 
REGEX_PATTERN_3|REGEX_PATTERN_4|REGEX_PATTERN_5|REGEX_PATTERN_6
REGEX_PATTERN_7|REGEX_PATTERN_8|REGEX_PATTERN_9|REGEX_PATTERN_10

With the preceding updates, you can increase the number of regex patterns in a regex pattern set.

The following example shows how to identify multiple domains in a single regex pattern set:

(example.com|example.net|example.org)

Note: This example shows regex patterns to identify the following domains: example.com, example.net, and example.org. Replace these domains with your domains.

Add regex pattern sets to your AWS WAF rules

Complete the following:

1. Open the AWS WAF console.
2. Under Rules, choose Add rules, and then choose Add my own rules and rule group.
3. For Inspect, select the request component.
4. For Match type, select Match patterns from Regex pattern set.
5. Select your regex pattern set.
6. Update the Rule Action based on your use case.
7. Choose Save.

Related information

Creating a regex pattern set

Regex match rule statement