Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article.
Maybe you should read it.
Maybe you should read it.
https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov...
For oversize requests WAF can be configured to reject it.
8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough.
Continuing, not blocking, is the default when not using the console, making this insecure by default.
And having an insecure default is a huge difference from 100% of requests are allowed.