Skip to content

AWS WAF

AWS WAF is a web application firewall. It inspects the HTTP and HTTPS requests forwarded to a protected resource and allows, blocks, counts or challenges them according to a web ACL — a set of rules evaluated in priority order. It operates at layer 7, so it sees the request itself: headers, body, query string, URI and the client’s behaviour over time.

  • Amazon CloudFront distribution
  • Amazon API Gateway REST API
  • Application Load Balancer
  • AWS AppSync GraphQL API
  • Amazon Cognito user pool
  • AWS App Runner service
  • AWS Verified Access instance
  • AWS Amplify
  • Amazon Bedrock AgentCore Gateway

Applications running in Amazon ECS are protected by putting them behind an Application Load Balancer that has a web ACL attached.

  • IP addresses the request originates from (IP sets)
  • Country of origin (geographic matching)
  • Values in HTTP headers
  • Query string parameters
  • Request body content
  • URI paths
  • Size constraints on request components
  • SQL injection patterns
  • Cross-site scripting patterns
  • Literal strings or regular expressions anywhere in the request
  • Request rate from a source, for rate-based rules
  • AWS Managed Rules groups, or rule groups you write yourself

A rule that matches produces one of five actions. The distinction between terminating and non-terminating matters: a terminating action ends evaluation of the whole web ACL for that request.

ActionTerminating?Effect
AllowYesThe matching request is forwarded to the protected resource. No further rules are evaluated.
BlockYesThe matching request is rejected. The default response is HTTP 403 Forbidden; a custom response can be configured. The protected resource never receives the request.
CountNoThe match is counted and evaluation continues with the next rule. This is how a rule is tested before it is allowed to block anything.
CAPTCHAConditionallyIf the request carries a valid CAPTCHA token, the match behaves like Count and evaluation continues. If not, evaluation terminates and the client is sent a CAPTCHA puzzle.
ChallengeConditionallyAs CAPTCHA, but the client is sent a silent background browser challenge rather than a puzzle. Used for bot mitigation without interrupting a human visitor.

CAPTCHA and Challenge are the bot-mitigation actions; both are billed separately from standard request inspection.

These are two different settings and confusing them is the most common source of an unexpectedly open or unexpectedly closed web ACL.

  • A rule action decides what happens to a request that matches that rule.
  • The web ACL default action decides what happens to a request that matches no terminating rule at all. Setting it to Allow makes the web ACL a deny-list; setting it to Block makes it an allow-list, and every legitimate request then needs a rule that allows it.

Rule priority interacts with this. Rules are evaluated from the lowest numeric priority upwards, and a terminating match stops the evaluation, so a Count rule placed after an Allow rule never sees the requests the Allow rule matched.

In the updated AWS WAF console a web ACL is presented as a protection pack; it is the same resource.