diff --git a/pkg/multicloud/aws/waf.go b/pkg/multicloud/aws/waf.go
index 1eebfc8025..8c9434efef 100644
--- a/pkg/multicloud/aws/waf.go
+++ b/pkg/multicloud/aws/waf.go
@@ -60,16 +60,8 @@ type SWebAcl struct {
 	region *SRegion
 	*wafv2.WebACL
 
-	scope                    string
-	ARN                      string
-	Description              string
-	Id                       string
-	LockToken                string
-	Name                     string
-	LabelNamespace           string
-	Capacity                 int
-	ManagedByFirewallManager bool
-	VisibilityConfig         SVisibilityConfig
+	scope     string
+	LockToken string
 }
 
 func (self *SRegion) ListWebACLs(scope string) ([]SWebAcl, error) {
@@ -116,7 +108,7 @@ func (self *SRegion) GetWebAcl(id, name, scope string) (*SWebAcl, error) {
 		return nil, errors.Wrapf(err, "GetWebAcl")
 	}
 	ret := &SWebAcl{region: self, scope: scope, WebACL: resp.WebACL, LockToken: *resp.LockToken}
-	return ret, jsonutils.Update(ret, resp)
+	return ret, nil
 }
 
 func (self *SRegion) DeleteWebAcl(id, name, scope, lockToken string) error {
@@ -189,15 +181,15 @@ func (self *SWebAcl) GetEnabled() bool {
 }
 
 func (self *SWebAcl) GetGlobalId() string {
-	return self.ARN
+	return *self.ARN
 }
 
 func (self *SWebAcl) GetName() string {
-	return self.Name
+	return *self.Name
 }
 
 func (self *SWebAcl) GetId() string {
-	return self.ARN
+	return *self.ARN
 }
 
 func (self *SWebAcl) GetWafType() cloudprovider.TWafType {
@@ -225,7 +217,7 @@ func (self *SWebAcl) GetDefaultAction() *cloudprovider.DefaultAction {
 }
 
 func (self *SWebAcl) Refresh() error {
-	acl, err := self.region.GetWebAcl(self.Id, self.Name, self.scope)
+	acl, err := self.region.GetWebAcl(*self.Id, *self.Name, self.scope)
 	if err != nil {
 		return errors.Wrapf(err, "GetWebAcl")
 	}
@@ -234,7 +226,7 @@ func (self *SWebAcl) Refresh() error {
 }
 
 func (self *SWebAcl) Delete() error {
-	return self.region.DeleteWebAcl(self.Id, self.Name, self.scope, self.LockToken)
+	return self.region.DeleteWebAcl(*self.Id, *self.Name, self.scope, self.LockToken)
 }
 
 func (self *SRegion) CreateICloudWafInstance(opts *cloudprovider.WafCreateOptions) (cloudprovider.ICloudWafInstance, error) {
@@ -456,10 +448,10 @@ func reverseConvertStatement(statement cloudprovider.SWafStatement) *wafv2.State
 func (self *SWebAcl) AddRule(opts *cloudprovider.SWafRule) (cloudprovider.ICloudWafRule, error) {
 	input := &wafv2.UpdateWebACLInput{}
 	input.SetLockToken(self.LockToken)
-	input.SetId(self.Id)
-	input.SetName(self.Name)
+	input.SetId(*self.Id)
+	input.SetName(*self.Name)
 	input.SetScope(self.scope)
-	input.SetDescription(self.Description)
+	input.SetDescription(*self.Description)
 	input.SetDefaultAction(self.DefaultAction)
 	input.SetVisibilityConfig(self.WebACL.VisibilityConfig)
 	rules := self.Rules
@@ -531,9 +523,9 @@ func (self *SWebAcl) AddRule(opts *cloudprovider.SWafRule) (cloudprovider.ICloud
 func (self *SWebAcl) GetCloudResources() ([]cloudprovider.SCloudResource, error) {
 	ret := []cloudprovider.SCloudResource{}
 	for _, resType := range []string{"APPLICATION_LOAD_BALANCER", "API_GATEWAY", "APPSYNC"} {
-		resIds, err := self.region.ListResourcesForWebACL(resType, self.ARN)
+		resIds, err := self.region.ListResourcesForWebACL(resType, *self.ARN)
 		if err != nil {
-			return nil, errors.Wrapf(err, "ListResourcesForWebACL(%s, %s)", resType, self.ARN)
+			return nil, errors.Wrapf(err, "ListResourcesForWebACL(%s, %s)", resType, *self.ARN)
 		}
 		for _, resId := range resIds {
 			ret = append(ret, cloudprovider.SCloudResource{
diff --git a/pkg/multicloud/aws/waf_rules.go b/pkg/multicloud/aws/waf_rules.go
index 351637e758..3bd8f2713e 100644
--- a/pkg/multicloud/aws/waf_rules.go
+++ b/pkg/multicloud/aws/waf_rules.go
@@ -72,10 +72,10 @@ func (self *sWafRule) Delete() error {
 	}
 	input.SetRules(rules)
 	input.SetLockToken(self.waf.LockToken)
-	input.SetId(self.waf.Id)
-	input.SetName(self.waf.Name)
+	input.SetId(*self.waf.Id)
+	input.SetName(*self.waf.Name)
 	input.SetScope(self.waf.scope)
-	input.SetDescription(self.waf.Description)
+	input.SetDescription(*self.waf.Description)
 	input.SetDefaultAction(self.waf.DefaultAction)
 	input.SetVisibilityConfig(self.waf.WebACL.VisibilityConfig)
 	client, err := self.waf.region.getWafClient()
@@ -147,7 +147,7 @@ func (self *sWafStatement) convert() cloudprovider.SWafStatement {
 		fillExcludeRules(&statement, self.ManagedRuleGroupStatement.ExcludedRules)
 	} else if self.RateBasedStatement != nil {
 		statement.Type = cloudprovider.WafStatementTypeRate
-		statement.MatchFieldValues = &cloudprovider.TWafMatchFieldValues{fmt.Sprintf("%d", self.RateBasedStatement.Limit)}
+		statement.MatchFieldValues = &cloudprovider.TWafMatchFieldValues{fmt.Sprintf("%d", *self.RateBasedStatement.Limit)}
 		if self.RateBasedStatement.ForwardedIPConfig != nil {
 			statement.ForwardedIPHeader = *self.RateBasedStatement.ForwardedIPConfig.HeaderName
 		}
@@ -181,6 +181,10 @@ func (self *sWafStatement) convert() cloudprovider.SWafStatement {
 		if self.LabelMatchStatement.Key != nil {
 			statement.MatchFieldValues = &cloudprovider.TWafMatchFieldValues{*self.LabelMatchStatement.Key}
 		}
+	} else if self.NotStatement != nil {
+		s := &sWafStatement{Statement: self.NotStatement.Statement}
+		statement = s.convert()
+		statement.Negation = true
 	}
 	return statement
 }
@@ -222,6 +226,8 @@ func fillTransformations(statement *cloudprovider.SWafStatement, trans []*wafv2.
 			values = append(values, cloudprovider.WafTextTransformationHtmlEntityDecode)
 		case wafv2.TextTransformationTypeCompressWhiteSpace:
 			values = append(values, cloudprovider.WafTextTransformationCompressWithSpace)
+		default:
+			values = append(values, cloudprovider.TWafTextTransformation(*tran.Type))
 		}
 	}
 	statement.Transformations = &values
diff --git a/pkg/multicloud/azure/waf.go b/pkg/multicloud/azure/waf.go
index c1fa910ef7..528f42ed92 100644
--- a/pkg/multicloud/azure/waf.go
+++ b/pkg/multicloud/azure/waf.go
@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
@@ -118,28 +119,25 @@ func wafMatchFieldAndKeyLocal2Cloud(opts cloudprovider.SWafStatement) ([]SMatchv
 	return ret, nil
 }
 
-func wafMatchFieldAndKeyCloud2Local(vars []SMatchvariable) (cloudprovider.TWafMatchField, string, error) {
-	for _, v := range vars {
-		switch v.Variablename {
-		case "QueryString":
-			return cloudprovider.WafMatchFieldQuery, v.Selector, nil
-		case "RequestMethod":
-			return cloudprovider.WafMatchFieldMethod, "", nil
-		case "RequestUri":
-			return cloudprovider.WafMatchFiledUriPath, "", nil
-		case "RequestHeaders":
-			return cloudprovider.WafMatchFiledHeader, v.Selector, nil
-		case "PostArgs":
-			return cloudprovider.WafMatchFiledPostArgs, v.Selector, nil
-		case "RequestBody":
-			return cloudprovider.WafMatchFieldBody, "", nil
-		case "RequestCookies":
-			return cloudprovider.WafMatchFiledCookie, v.Selector, nil
-		default:
-			return "", "", fmt.Errorf("invalid variablename %s", v.Variablename)
-		}
+func wafMatchFieldAndKeyCloud2Local(v SMatchvariable) (cloudprovider.TWafMatchField, string, error) {
+	switch v.Variablename {
+	case "QueryString":
+		return cloudprovider.WafMatchFieldQuery, v.Selector, nil
+	case "RequestMethod":
+		return cloudprovider.WafMatchFieldMethod, "", nil
+	case "RequestUri":
+		return cloudprovider.WafMatchFiledUriPath, "", nil
+	case "RequestHeaders":
+		return cloudprovider.WafMatchFiledHeader, v.Selector, nil
+	case "PostArgs":
+		return cloudprovider.WafMatchFiledPostArgs, v.Selector, nil
+	case "RequestBody":
+		return cloudprovider.WafMatchFieldBody, "", nil
+	case "RequestCookies":
+		return cloudprovider.WafMatchFiledCookie, v.Selector, nil
+	default:
+		return "", "", fmt.Errorf("invalid variablename %s", v.Variablename)
 	}
-	return "", "", nil
 }
 
 func wafStatementLocal2Cloud(opts cloudprovider.SWafStatement) (SMatchcondition, error) {
@@ -272,7 +270,6 @@ func (self *CustomRule) GetStatements() ([]cloudprovider.SWafStatement, error) {
 			Transformations:  &trans,
 			MatchFieldValues: &values,
 		}
-		statement.MatchField, statement.MatchFieldKey, _ = wafMatchFieldAndKeyCloud2Local(condition.Matchvariables)
 		switch condition.Operator {
 		case "IPMatch":
 			statement.Type = cloudprovider.WafStatementTypeIPSet
@@ -299,7 +296,16 @@ func (self *CustomRule) GetStatements() ([]cloudprovider.SWafStatement, error) {
 		default:
 			statement.Type = cloudprovider.WafStatementTypeByteMatch
 		}
-		ret = append(ret, statement)
+
+		var err error
+		for _, v := range condition.Matchvariables {
+			statement.MatchField, statement.MatchFieldKey, err = wafMatchFieldAndKeyCloud2Local(v)
+			if err != nil {
+				log.Errorf("wafMatchFieldAndKeyCloud2Local %s error: %v", v, err)
+				continue
+			}
+			ret = append(ret, statement)
+		}
 	}
 	return ret, nil
 }