A customer clicks Save in your app and gets a 403 Forbidden response. You check the application logs, but there is no failed save to inspect. The app is healthy, other pages work, and the deployment finished without errors.
A web application firewall (WAF) can cause exactly this kind of failure. It inspects traffic before your app handles it. If a rule blocks the request, your handler never runs, so adding more logging inside that handler won't explain the block.
AWS provides tools to investigate WAF decisions. The work is connecting the customer report to the right firewall, log destination, and rule. Forte brings the blocked traffic into the Service or Website you're already investigating, with reasons, affected routes, and sample requests.
Why a blocked request can be hard to find
Consider a hypothetical document editor whose API runs behind CloudFront and AWS WAF. A customer can open a document but cannot save one particular edit. Their browser shows that POST /api/documents/123 failed.
Start by recording the request time, including its timezone, the hostname, the method, and the path. A 403 alone doesn't establish that the WAF caused it. Authentication, application permissions, and other layers can return the same status.
The missing application log is a clue that the request may have stopped earlier. If a firewall sits in front of the app, investigate its records before changing the save handler.
This becomes harder when the firewall and hosting service have separate dashboards. You need to know which edge resource protects the hostname and where its firewall records go. The customer knows only that Save failed.
Follow the AWS WAF decision
In AWS WAF, rules belong to a web access control list, or web ACL, associated with a protected AWS resource. Find the web ACL for the resource handling the failed request. Check that you're looking at the intended environment.
AWS WAF offers sampled requests in its console. These can help identify a matching rule, but the sample is a limited view of recent traffic. An absent entry doesn't establish that the request was allowed. AWS sampled-request documentation
For detailed investigation, use the web ACL's configured log destination. AWS supports CloudWatch Logs, S3, and Data Firehose. Logging needs to have been enabled for the event you want to inspect; enabling it after the report doesn't recover that earlier event. AWS WAF logging documentation
If you send WAF logs to CloudWatch Logs, select that log group and a narrow time window around the report. This Logs Insights query finds recent blocks on the example route:
fields @timestamp, httpRequest.httpMethod, httpRequest.uri,
action, terminatingRuleId, ruleGroupList
| filter action = "BLOCK"
| filter httpRequest.httpMethod = "POST"
| filter httpRequest.uri = "/api/documents/123"
| sort @timestamp desc
| limit 50Check the hostname and other request metadata in the matching record before connecting it to the customer. A busy route may have unrelated blocks in the same time window.
The action field records the final WAF action. terminatingRuleId identifies the rule that ended evaluation; for a managed rule group, inspect ruleGroupList to find the rule inside that group. Match details vary by rule type, so the record may not explain the exact input that triggered it. AWS WAF log field reference
That gives you evidence to investigate a false positive. A rule match alone doesn't establish whether the customer's input was safe.
Open the blocked route directly in Forte
Forte's managed firewall records requests it blocks before they reach your app. Open the affected Service or Website, then choose Monitoring → Blocked Requests. The view covers the last seven days and starts with the Possible false positive category.
Requests are grouped by HTTP method, route pattern, and block reason. Each group shows its block count and when it was last seen. Open a group to inspect recent samples with their timestamps, paths, client IPs, countries, and user agents.
For the document editor, look for the affected POST route and compare its samples with the customer's report. A reason such as Request body contained HTML or script gives you a specific lead to test with safe example content.
| Investigation task | With your own AWS WAF setup | In Forte |
|---|---|---|
| Find the affected traffic | Locate the protecting web ACL and its samples or log destination | Open Blocked Requests on the affected Service or Website |
| Understand the block | Inspect the action, terminating rule, and managed rule group details | Read the group's block reason and category |
| Compare with the report | Search request metadata around the reported time | Open the group's recent samples |
| Ask for a review | Collect the resource and request details for your investigation | Choose Get help to prepare a support case with the selected context |
The firewall metadata release note describes this view. You don't need to configure a separate AWS log destination to use it in Forte.
Know what the view can establish
The category is a review aid. Possible false positive means the block deserves investigation; it doesn't certify that the request was harmless. You can also inspect Attack traffic and Rate limited when those categories fit the report.
The detail view shows up to 25 recent samples for a group. Samples are limited, and ingestion is periodic, so this is neither a complete request archive nor an instant view of a retry. It also doesn't expose a full blocked request body.
Blocked-request visibility applies to both Services and Websites. It is separate from the Service request logs that show requests handled through Forte's gateway. A firewall block has no application execution to inspect.
Turn the evidence into a useful next step
If the document save appears legitimate, choose Get help on its group or sample. Forte prepares a support draft with the resource, time range, route, reason, and selected sample context. Review it and explain what the customer was trying to do before submitting it.
Use synthetic content to reproduce the issue without copying private documents or credentials into the case. After a correction, repeat the original save through the public hostname and check that the document actually persists.
Read how to investigate WAF false positives for the next part of that process. To evaluate the workflow with your own app, start with Forte Compute or Forte Websites.