What AWS WAF does
AWS WAF is a web application firewall. It inspects HTTP and HTTPS requests before they reach your application and decides, based on rules you choose, whether to allow them, block them, count them, or ask the client to prove it is a real browser. It can match on IP addresses, headers, query strings, the URI path, the request body, geography and request rates, and it protects against common attacks such as SQL injection and cross-site scripting through managed rule sets.
It does not run on your servers. It is attached to an AWS resource that sits in front of your application, and every request that resource receives is evaluated first.
Where AWS WAF attaches
According to Resources that you can protect, AWS WAF can protect:
- Amazon CloudFront distributions
- Application Load Balancers
- Amazon API Gateway REST APIs
- AWS AppSync GraphQL APIs
- Amazon Cognito user pools
- AWS App Runner services
- AWS Verified Access instances
- AWS Amplify apps
- Amazon Bedrock AgentCore Gateway
For CloudFront, the web ACL and everything it uses must be created in US East (N. Virginia), shown in some interfaces as “Global (CloudFront)”. For regional resources, the web ACL must be in the same Region as the resource. Each resource can have only one web ACL, but one web ACL can protect many resources.
If you use CloudFront in front of a load balancer, attaching AWS WAF at CloudFront blocks bad traffic at the edge, before it reaches your Region.
The building blocks
Web ACLs
A web ACL is the top-level object you attach to a resource. The new AWS WAF console calls it a protection pack (web ACL); the API still calls it a web ACL. It holds an ordered list of rules and rule groups and a default action, Allow or Block, that applies to requests no rule terminates. Most public sites use a default of Allow with rules that block known bad traffic. Internal or partner-only applications often use Block with rules that allow known sources.
Each web ACL has a capacity measured in web ACL capacity units (WCUs). Per the WCU documentation, the base price includes up to 1,500 WCUs, more costs extra, and the maximum is 5,000. Regex and body inspection rules use more capacity than simple matches.
Rules and rule groups
A rule is a match statement plus an action. Statements can be combined with AND, OR and NOT, and can inspect a part of the request after text transformations such as URL decoding or lowercasing. Rules are evaluated in priority order.
A rule group is a reusable set of rules with a fixed capacity. You can write your own, use AWS Managed Rules, or subscribe to rule groups from sellers in AWS Marketplace.
AWS Managed Rules
AWS Managed Rules are rule groups that AWS writes and maintains. Common starting points include:
AWSManagedRulesCommonRuleSet(the core rule set), covering a broad range of common web exploits.AWSManagedRulesKnownBadInputsRuleSet, for request patterns known to be malicious.AWSManagedRulesSQLiRuleSet, for SQL injection.AWSManagedRulesAmazonIpReputationList, for IP addresses AWS threat intelligence associates with bots and other threats.- Use-case groups for specific stacks, such as Linux, PHP or WordPress applications.
You can override the action of individual rules inside a managed group, typically setting a noisy rule to Count while you investigate it.
Rule actions
AWS WAF rule actions are:
- Allow: forward the request to the resource. Terminating.
- Block: stop the request. By default the client gets HTTP 403, and you can define a custom response. Terminating.
- Count: record the match and carry on evaluating the remaining rules. Non-terminating. You can add labels that later rules match on.
- CAPTCHA: show a puzzle to the client unless it already has a valid token.
- Challenge: run a silent browser challenge unless the client already has a valid token.
CAPTCHA and Challenge only work for browsers calling HTTPS endpoints, and they carry extra charges. Do not use them on API endpoints called by machines, because those clients cannot solve the challenge.
Count is how you test. There is no separate “monitoring mode”: you set a rule, or a whole managed rule group, to Count, watch what it would have matched, and then switch it to its real action.
Rate-based rules
A rate-based rule counts requests per aggregation key, such as client IP address, and applies its action once the count passes a limit within an evaluation window of 1, 2, 5 or 10 minutes. The lowest limit you can set is 10, and you can use any action except Allow. A scope-down statement limits which requests are counted, for example only login attempts:
{
"Name": "rate-limit-login",
"Priority": 10,
"Statement": {
"RateBasedStatement": {
"Limit": 100,
"EvaluationWindowSec": 300,
"AggregateKeyType": "IP",
"ScopeDownStatement": {
"ByteMatchStatement": {
"SearchString": "/login",
"FieldToMatch": { "UriPath": {} },
"TextTransformations": [{ "Priority": 0, "Type": "NONE" }],
"PositionalConstraint": "STARTS_WITH"
}
}
}
},
"Action": { "Block": {} },
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "rate-limit-login"
}
}AWS notes that rate limiting is applied near the limit you set, not exactly at it. If AWS WAF sits behind a proxy or another CDN, aggregate on the forwarded IP header rather than the connecting IP.
Bot Control
AWS WAF Bot Control is a paid managed rule group with two protection levels:
- Common: labels self-identifying bots, verifies generally desirable ones such as search engine crawlers, and detects high-confidence bot signatures.
- Targeted: adds detection for sophisticated bots that do not identify themselves, using browser interrogation, fingerprinting and behavior heuristics, with optional machine learning analysis.
Bot Control labels each request with the bot category and name, so you can write your own rules that, for example, allow verified search engines but rate limit unverified scrapers. For login and sign-up abuse, AWS also offers the AWS WAF Fraud Control managed rule groups.
Logging and monitoring
AWS WAF publishes Amazon CloudWatch metrics for each rule and keeps sampled requests you can view in the console. For full detail, turn on web ACL logging to Amazon CloudWatch Logs, Amazon S3 or Amazon Data Firehose. The destination name must start with aws-waf-logs-. You can redact fields such as authorization headers and filter which requests are logged to control cost.
A safe way to get started
- Create a web ACL with a default action of Allow and attach it to your CloudFront distribution or load balancer.
- Add the core rule set, known bad inputs and IP reputation groups, all set to Count.
- Turn on logging and review matches for a week or two of normal traffic.
- Fix false positives with rule action overrides or scope-down statements, then switch the groups to Block.
- Add a rate-based rule for login and other sensitive paths.
- Add Bot Control if bots are a real cost or risk for you.
If you run many accounts, AWS Firewall Manager can apply a baseline web ACL across your AWS Organizations organization.
9Acts is an AWS Advanced Tier Services Partner with the AWS Level 1 MSSP Competency. For help designing and tuning AWS WAF for your applications, see our security and compliance services.