This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.