AWS WAF adds pre-parse transformations and new text transformations
AWS WAF now supports pre-parse text transformations for query arguments and ten new text transformations, enhancing request normalization. These features help standardize how AWS WAF inspects requests, preventing evasion tactics like HTTP parameter pollution and parser differentials. The update is available in all AWS Regions and impacts engineers and architects responsible for web application security.
- →Pre-parse text transformations for query arguments
- →Ten new text transformations for rule statements
- →Chaining transformations for advanced request normalization
- →New transformations consume 10 WCUs, available regionally
Features (2) ›
- Pre-parse text transformations for query arguments
AWS WAF now supports pre-parse text transformations for query arguments, which normalize raw query strings before they are parsed into key-value pairs. This addresses HTTP parameter pollution and parser differential evasion vulnerabilities.
- Ten new text transformations for rule statements
Ten new text transformations are available for use in any AWS WAF rule statement, offering more ways to normalize content before inspection. These include standard options like Uppercase, Trim, Remove Whitespace, SHA256, and specialized decoding functions.
Enhancements (1) ›
- Chaining transformations for advanced request normalization
Users can now chain up to ten transformations, including URL decode and Combine Duplicate Query Arguments by Comma, and then apply standard post-parse transformations within a single rule statement. This enables more sophisticated request content normalization.
Notes (1) ›
- New transformations consume 10 WCUs, available regionally
Each new transformation consumes 10 WCUs with no additional charge beyond standard AWS WAF pricing. These features are available in all AWS Regions.
https://aws.amazon.com/about-aws/whats-new/2026/07/aws-waf/
Related releases
- AWS End User Messaging Adds Dynamic WhatsApp Flow Support AWS What's New ·
- AWS End User Messaging strengthens SMS deliverability with automatic failover AWS What's New ·
- SageMaker JumpStart adds NVIDIA Qwen3.6-35B-A3B-NVFP4 and Alibaba Wan2.1-T2V-1.3B models AWS What's New ·
- Amazon SageMaker JumpStart Adds Granite-Speech, Kanana-2, and OpenFold3 Models AWS What's New ·
- Mistral AI's Ministral-3 Models Now on Amazon SageMaker JumpStart AWS What's New ·
- Gemma-4-31B LLMs from Google DeepMind and NVIDIA now on SageMaker JumpStart AWS What's New ·