What is the danger of a WAF's request-inspection limit, illustrated by the default rule sets of AWS and Google that checked only the first 8 KB of a request?

Question

Accepted Answer

Anything beyond the inspected part is never checked: an attacker can pad a request with harmless filler and place the payload behind the limit. Larger requests are only inspected if extra rules are set up manually.

* The rules only see the first part of the body; a payload placed after the limit passes unchecked. *
Inspecting a request costs time and memory, so cloud WAFs cap how much of a request body their rules read. With the default rule sets of AWS and Google cited at 8 KB, a large form submission, an upload or a big JSON body is only partially checked. Unless someone knows about the limit and adds rules for oversized requests (block them, or extend the inspection), the WAF gives a false sense of coverage for exactly the requests an attacker can make large on purpose.
The exact numbers move with the products: AWS WAF still inspects 8 KB of the body behind an Application Load Balancer, but 16 KB by default (configurable up to 64 KB) for CloudFront and API Gateway; Google Cloud Armor now inspects up to 64 kB. The lesson stays the same: know your WAF's limits, because they are part of your attack surface.
Go deeper:

AWS WAF — Oversize web request components — the per-service body inspection limits and how to handle oversized requests.
 Google Cloud Armor — Security policy overview — includes the request body inspection limit among the limitations.