WAF Policy Managed Rule Exclusion Remove Rule not working as expected

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Related command az network application-gateway waf-policy managed-rule exclusion rule-set remove

Describe the bug

• The above command is supposed to remove a Rule from an exception in Managed Rules Exclusion of App gateway WAF Policy
• However, instead, I notice every other rule under OWASP is getting added to the exclusion

To Reproduce

• Add a test exclusion to the Managed Rules from Portal
• Make sure the exclusion contains a Rule from the Managed Rule Group.
• Now, with Azure CLI, execute the above command specifying the Rule Group name to remove it
• Instead of the Rule Group getting removed, I see every rule under OWASP is getting added to the exclusion

Expected behavior

The Rule Group associated to the specified exclusion policy should have been removed

Environment summary

• Contains an App gateway WAF policy
• I was using OWASP 3.2

Additional context NA

[KapilAnanth-MSFT]

@necusjz , I was using Azure Cloudshell to repo this.

1. I am adding a Rule Group Exclusion

az network application-gateway waf-policy managed-rule exclusion rule-set add -g appGateway --policy-name appGatewayPolicy --match-variable RequestHeaderValues --match-operator Contains --selector kapil --type OWASP --version 3.2 --group-name REQUEST-921-PROTOCOL-ATTACK --rule-ids 921140 921150

1. I am adding the second Rule Group Exclusion

az network application-gateway waf-policy managed-rule exclusion rule-set add -g appGateway --policy-name appGatewayPolicy --match-variable RequestHeaderNames --match-operator StartsWith --selector Bing --type OWASP --version 3.2 --group-name REQUEST-920-PROTOCOL-ENFORCEMENT --rule-ids 920340

1. I am trying to delete the first Rule Group Exclusion

az network application-gateway waf-policy managed-rule exclusion rule-set remove -g appGateway --policy-name appGatewayPolicy --match-variable RequestHeaderValues --match-operator Contains --selector kapil --type OWASP --version 3.2 --group-name REQUEST-921-PROTOCOL-ATTACK

1. Post this, I can see all the Rule Groups getting added to the Exclusion.

My cloudshell azure-CLI version is 2.41.0

[necusjz]

@KapilAnanth-MSFT I haven’t reproduced this issue yet, my procedures are as follows:

1. Create a waf-policy

az network application-gateway waf-policy create -g {rg} -n {waf}

1. Add one rule group to exclusion

az network application-gateway waf-policy managed-rule exclusion rule-set add -g {rg} --policy-name {waf} --match-variable RequestHeaderNames --match-operator StartsWith --selector Bing --type OWASP --version 3.2 --group-name REQUEST-921-PROTOCOL-ATTACK --rule-ids 921140 921150

1. Add another rule group to exclusion

az network application-gateway waf-policy managed-rule exclusion rule-set add -g {rg} --policy-name {waf} --match-variable RequestHeaderNames --match-operator StartsWith --selector Bing --type OWASP --version 3.2 --group-name REQUEST-931-APPLICATION-ATTACK-RFI --rule-ids 931100

1. Remove the first rule group

az network application-gateway waf-policy managed-rule exclusion rule-set remove -g {rg} --policy-name {waf} --match-variable RequestHeaderNames --match-operator StartsWith --selector Bing --type OWASP --version 3.2 --group-name REQUEST-921-PROTOCOL-ATTACK