ReleaseBytes
aws AWS What's New ·

AWS WAF adds pre-parse transformations and new text transformations

securityawsengineerretail
feature

AWS WAF now supports pre-parse text transformations for query arguments and ten new text transformations, enhancing request normalization. These features help standardize how AWS WAF inspects requests, preventing evasion tactics like HTTP parameter pollution and parser differentials. The update is available in all AWS Regions and impacts engineers and architects responsible for web application security.

  • →Pre-parse text transformations for query arguments
  • →Ten new text transformations for rule statements
  • →Chaining transformations for advanced request normalization
  • →New transformations consume 10 WCUs, available regionally
Features (2) ›
  • Pre-parse text transformations for query arguments

    AWS WAF now supports pre-parse text transformations for query arguments, which normalize raw query strings before they are parsed into key-value pairs. This addresses HTTP parameter pollution and parser differential evasion vulnerabilities.

  • Ten new text transformations for rule statements

    Ten new text transformations are available for use in any AWS WAF rule statement, offering more ways to normalize content before inspection. These include standard options like Uppercase, Trim, Remove Whitespace, SHA256, and specialized decoding functions.

Enhancements (1) ›
  • Chaining transformations for advanced request normalization

    Users can now chain up to ten transformations, including URL decode and Combine Duplicate Query Arguments by Comma, and then apply standard post-parse transformations within a single rule statement. This enables more sophisticated request content normalization.

Notes (1) ›
  • New transformations consume 10 WCUs, available regionally

    Each new transformation consumes 10 WCUs with no additional charge beyond standard AWS WAF pricing. These features are available in all AWS Regions.

Read the original announcement →

https://aws.amazon.com/about-aws/whats-new/2026/07/aws-waf/

Related releases