A large AWS user is concerned about potential false positives and rule duplication when centrally managing their existing F5 marketplace rules for APIs via AWS Firewall Manager.

{
  "signal_id": "05bda07c-6205-5b76-a37b-b1dca84b7991",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-09-21T12:33:35+00:00",
  "company": {
    "name": "F5",
    "domain": "f5.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "cloud security",
      "waf",
      "false positives",
      "api security",
      "centralized management"
    ],
    "post_id": "1wmbi4r",
    "summary": "A large AWS user is concerned about potential false positives and rule duplication when centrally managing their existing F5 marketplace rules for APIs via AWS Firewall Manager.",
    "category": "usability",
    "comments": [
      {
        "url": "https://www.reddit.com/r/aws/comments/1wmbi4r/comment/pbsqpnb/",
        "depth": 0,
        "score": 3,
        "author": "RecordingForward2690",
        "excerpt": "We have a slightly smaller organisation with just about 90 accounts and maybe around 200 or so WAF-protected resources. When we implemented Firewall Manager, we first made the decision to keep it simple: Just two WAF definitions: Private and Public. With the notion that if an application really needed something custom, they could always do their own WAF but were then also responsible for it.\n\n Pub",
        "posted_at": "2026-09-24T16:40:29.000Z",
        "author_url": "https://www.reddit.com/user/RecordingForward2690/"
      }
    ],
    "evidence": [
      "[post] Did you centralize F5/Fortinet via FMS, or did you leave them under user control? → We want to centralize F5 for APIs and Fortinet for ALBs, but we’re particularly concerned about false positives (e.g., a specific F5 rule causing issues for a particular account).",
      "[post] 💡 Key Concerns: Avoiding false positives (e.g., ensuring a specific F5 rule doesn’t block legitimate traffic for a particular account). Rule coexistence (e.g., temporary duplication of F5/Fortinet rules during migration)."
    ],
    "virality": "very_low",
    "post_date": "2026-09-21T12:33:35.000Z",
    "post_kind": "text",
    "post_text": "Hi r/aws,\n\nWe’re planning to deploy AWS Firewall Manager (FMS) with WAFv2 across an AWS organization with 334 active accounts, including:\n\n725 CloudFront distributions,\n\n44 public ALBs and 12 public API Gateway stages,\n\n431 attached Web ACLs (157 in production).\n\nOur goal is to centralize a common baseline (IP blacklist, geoblocking, AWS Managed Rules) while preserving user-managed application-specific rules (allowlists, rate limits, CAPTCHA, etc.).\n\n🔍 Questions for the Community:\n\nImplementation Mode:\n\nDid you use RETROFIT_EXISTING (injecting the baseline into existing Web ACLs) or a full replacement of ACLs? → We’re leaning toward RETROFIT_EXISTING to preserve user-managed rules, but we’re concerned about temporary rule duplication (e.g., F5/Fortinet rules existing both locally and centrally).\n\nPhased Migration:\n\nHow did you structure your migration (by resource type, environment, etc.)?\n\nHow did you handle exceptions (e.g., accounts with different IP profiles like X-Forwarded-For vs. origin)?\n\nMarketplace Rules (F5/Fortinet) Management:\n\nDid you centralize F5/Fortinet via FMS, or did you leave them under user control? → We want to centralize F5 for APIs and Fortinet for ALBs, but we’re particularly concerned about false positives (e.g., a specific F5 rule causing issues for a particular account). How did you ensure these didn’t disrupt legitimate traffic?\n\n💡 Key...",
    "sentiment": "neutral",
    "subreddit": "aws",
    "post_flair": [
      "architecture"
    ],
    "post_title": "🚀 [AWS Firewall Manager] Large-Scale Deployment Experiences & False Positive Management",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/aws/comments/1wmbi4r/aws_firewall_manager_largescale_deployment/",
    "entity_role": "vendor",
    "post_author": "GugWTF",
    "upvote_ratio": 1,
    "mention_count": 7,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/aws/",
    "total_upvotes": 4,
    "comments_total": 1,
    "total_comments": 1,
    "other_companies": [
      {
        "name": "Amazon Web Services",
        "role": "partner",
        "domain": "amazon.com"
      },
      {
        "name": "Fortinet",
        "role": "alternative",
        "domain": "fortinet.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/GugWTF/",
    "signal_category": "feedback",
    "comments_included": 1,
    "products_mentioned": [
      "F5 Marketplace Rules"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/05bda07c-6205-5b76-a37b-b1dca84b7991 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"f5.com","limit":20}'