AWS WAF Rule for blocking WordPress search requests by Bingbot

bingbotsearch.json

{
  "Name": "BingbotSearch",
  "Priority": 13,
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "SearchString": "bingbot",
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "user-agent"
              }
            },
            "TextTransformations": [
              {
                "Priority": 0,
                "Type": "NONE"
              }
            ],
            "PositionalConstraint": "CONTAINS"
          }
        },
        {
          "SizeConstraintStatement": {
            "FieldToMatch": {
              "SingleQueryArgument": {
                "Name": "s"
              }
            },
            "ComparisonOperator": "GT",
            "Size": 0,
            "TextTransformations": [
              {
                "Priority": 0,
                "Type": "NONE"
              }
            ]
          }
        }
      ]
    }
  },
  "Action": {
    "Block": {
      "CustomResponse": {
        "ResponseCode": 429
      }
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "BingbotSearch"
  }
}

For some reason Bingbot is sending (replaying?) search requests that have no relevance to the site. (Weird stuff like /?s=erotic+sims+4+mods)

I don't know how to block these without blocking non-search pages, which should still be indexed. Just adding nofollow etc to the meta data for searches doesn't prevent the searches from happening.

This AWS WAF rule blocks any User-Agent containing "bingbot" from making WordPress style searches ?s= - obviously it needs User-Agent to be preserved at the point of assessment.