AWS WAF
AWS WAF is a web application firewall. It inspects the HTTP and HTTPS requests forwarded to a protected resource and allows, blocks, counts or challenges them according to a web ACL — a set of rules evaluated in priority order. It operates at layer 7, so it sees the request itself: headers, body, query string, URI and the client’s behaviour over time.
Protected resources
Section titled “Protected resources”- Amazon CloudFront distribution
- Amazon API Gateway REST API
- Application Load Balancer
- AWS AppSync GraphQL API
- Amazon Cognito user pool
- AWS App Runner service
- AWS Verified Access instance
- AWS Amplify
- Amazon Bedrock AgentCore Gateway
Applications running in Amazon ECS are protected by putting them behind an Application Load Balancer that has a web ACL attached.
What a rule can match on
Section titled “What a rule can match on”- IP addresses the request originates from (IP sets)
- Country of origin (geographic matching)
- Values in HTTP headers
- Query string parameters
- Request body content
- URI paths
- Size constraints on request components
- SQL injection patterns
- Cross-site scripting patterns
- Literal strings or regular expressions anywhere in the request
- Request rate from a source, for rate-based rules
- AWS Managed Rules groups, or rule groups you write yourself
Rule actions
Section titled “Rule actions”A rule that matches produces one of five actions. The distinction between terminating and non-terminating matters: a terminating action ends evaluation of the whole web ACL for that request.
| Action | Terminating? | Effect |
|---|---|---|
| Allow | Yes | The matching request is forwarded to the protected resource. No further rules are evaluated. |
| Block | Yes | The matching request is rejected. The default response is HTTP 403 Forbidden; a custom response can be configured. The protected resource never receives the request. |
| Count | No | The match is counted and evaluation continues with the next rule. This is how a rule is tested before it is allowed to block anything. |
| CAPTCHA | Conditionally | If the request carries a valid CAPTCHA token, the match behaves like Count and evaluation continues. If not, evaluation terminates and the client is sent a CAPTCHA puzzle. |
| Challenge | Conditionally | As CAPTCHA, but the client is sent a silent background browser challenge rather than a puzzle. Used for bot mitigation without interrupting a human visitor. |
CAPTCHA and Challenge are the bot-mitigation actions; both are billed separately from standard request inspection.
Rule action versus default action
Section titled “Rule action versus default action”These are two different settings and confusing them is the most common source of an unexpectedly open or unexpectedly closed web ACL.
- A rule action decides what happens to a request that matches that rule.
- The web ACL default action decides what happens to a request that matches no terminating rule at all. Setting it to Allow makes the web ACL a deny-list; setting it to Block makes it an allow-list, and every legitimate request then needs a rule that allows it.
Rule priority interacts with this. Rules are evaluated from the lowest numeric priority upwards, and a terminating match stops the evaluation, so a Count rule placed after an Allow rule never sees the requests the Allow rule matched.
In the updated AWS WAF console a web ACL is presented as a protection pack; it is the same resource.