# AWS WAF Explained: How the Web Application Firewall Protects Your Applications

Key Takeaways

  • AWS WAF (Web Application Firewall) inspects HTTP/HTTPS requests before they reach your application and blocks malicious patterns like SQL injection and XSS.
  • It attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync — no infrastructure changes needed.
  • AWS Managed Rule Groups cover OWASP Top 10 risks out of the box; you can layer custom rules on top.
  • Rate-based rules stop brute-force and credential-stuffing attempts without needing a separate bot-management product.
  • Pricing is per web ACL, per rule, and per million requests — predictable and scales with traffic.

What Is AWS WAF?

AWS WAF is a managed web application firewall that sits in front of your application-facing AWS resources and inspects every incoming request against a set of rules you define. If a request matches a rule tagged "block," AWS WAF stops it before it ever reaches your origin server. This is the core answer to "what is web application firewall amazon" — it's a request-filtering layer, not a network firewall like a security group.

Unlike a traditional on-premises WAF appliance, AWS WAF requires no servers to patch or scale. You attach a Web ACL (Access Control List) to a resource, and AWS handles the inspection at the edge or at the load balancer.

Where AWS WAF Attaches

AWS WAF web ACLs can protect:

  • Amazon CloudFront distributions (edge-level, global)
  • Application Load Balancer (ALB)
  • Amazon API Gateway (REST and HTTP APIs)
  • AWS AppSync GraphQL APIs
  • AWS Amplify apps

This flexibility means you get the same rule engine whether you're protecting a static site behind CloudFront or a microservices API behind ALB.

Core Building Blocks

Web ACL

The container that holds your rules and defines the default action (ALLOW or BLOCK) for anything that doesn't match a rule.

Rules and Rule Groups

A rule is a single condition (e.g., "block if URI contains /admin and source IP is not in allowlist"). AWS bundles curated rules into Managed Rule Groups:

  • AWSManagedRulesCommonRuleSet — general protection
  • AWSManagedRulesSQLiRuleSet — SQL injection
  • AWSManagedRulesKnownBadInputsRuleSet — known exploit signatures
  • AWSManagedRulesBotControlRuleSet — bot detection (paid add-on)

Rate-Based Rules

These track request counts per IP over a 5-minute window and block IPs that exceed a threshold — the standard defense against credential stuffing and scraping.

Creating a Web ACL via CLI

aws wafv2 create-web-acl \
  --name f9-production-waf \
  --scope REGIONAL \
  --default-action Allow={} \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=f9ProdWaf \
  --rules file://waf-rules.json \
  --region us-east-1

For CloudFront (global resources), the --scope must be CLOUDFRONT and the command must run against the us-east-1 endpoint regardless of where your distribution's origin lives.

Example Rule Set (waf-rules.json)

[
  {
    "Name": "AWS-AWSManagedRulesCommonRuleSet",
    "Priority": 0,
    "OverrideAction": { "None": {} },
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesCommonRuleSet"
      }
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "CommonRuleSet"
    }
  },
  {
    "Name": "RateLimitLogin",
    "Priority": 1,
    "Action": { "Block": {} },
    "Statement": {
      "RateBasedStatement": {
        "Limit": 500,
        "AggregateKeyType": "IP",
        "ScopeDownStatement": {
          "ByteMatchStatement": {
            "SearchString": "/login",
            "FieldToMatch": { "UriPath": {} },
            "TextTransformations": [{ "Priority": 0, "Type": "NONE" }],
            "PositionalConstraint": "STARTS_WITH"
          }
        }
      }
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "RateLimitLogin"
    }
  }
]

This configuration applies AWS's common rule set to every request and rate-limits requests to /login at 500 requests per 5 minutes per IP — a practical defense against automated login attempts.

Traffic Flow Through AWS WAF

<svg viewBox="0 0 760 260" xmlns="http://www.w3.org/2000/svg" font-family="Arial, sans-serif" font-size="13" fill="currentColor">
  <style>
    .box { fill: none; stroke: currentColor; stroke-width: 1.6; rx: 8; }
    .arrow { stroke: currentColor; stroke-width: 1.6; fill: none; marker-end: url(#arrowhead); }
    .label { fill: currentColor; }
  </style>
  <defs>
    <marker id="arrowhead" markerWidth="10" markerHeight="7" refX="9" refY="3.5" orient="auto">
      <polygon points="0 0, 10 3.5, 0 7" fill="currentColor"/>
    </marker>
  </defs>

  <rect class="box" x="20" y="100" width="110" height="60"/>
  <text class="label" x="75" y="135" text-anchor="middle">Client</text>

  <line class="arrow" x1="130" y1="130" x2="210" y2="130"/>

  <rect class="box" x="210" y="80" width="150" height="100"/>
  <text class="label" x="285" y="120" text-anchor="middle">AWS WAF</text>
  <text class="label" x="285" y="140" text-anchor="middle">Web ACL</text>
  <text class="label" x="285" y="160" text-anchor="middle">(rules evaluated)</text>

  <line class="arrow" x1="360" y1="130" x2="440" y2="130"/>
  <text class="label" x="400" y="115" text-anchor="middle">allow</text>

  <rect class="box" x="440" y="80" width="140" height="100"/>
  <text class="label" x="510" y="120" text-anchor="middle">CloudFront /</text>
  <text class="label" x="510" y="140" text-anchor="middle">ALB / API GW</text>

  <line class="arrow" x1="580" y1="130" x2="660" y2="130"/>

  <rect class="box" x="660" y="100" width="80" height="60"/>
  <text class="label" x="700" y="135" text-anchor="middle">Origin</text>

  <line class="arrow" x1="285" y1="180" x2="285" y2="230"/>
  <text class="label" x="285" y="250" text-anchor="middle">blocked → 403 response</text>
</svg>

Monitoring with CloudWatch

Every rule emits CloudWatch metrics (allowed/blocked counts). Set up an alarm to catch spikes that indicate an active attack:

aws cloudwatch put-metric-alarm \
  --alarm-name waf-blocked-spike \
  --namespace AWS/WAFV2 \
  --metric-name BlockedRequests \
  --dimensions Name=WebACL,Value=f9-production-waf Name=Region,Value=us-east-1 Name=Rule,Value=ALL \
  --statistic Sum \
  --period 300 \
  --threshold 1000 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts

Pricing Basics

AWS WAF charges roughly:

  • $5.00/month per web ACL
  • $1.00/month per rule
  • $0.60 per million requests inspected

Managed Rule Groups from AWS or third parties may add a small subscription fee, but the baseline cost for protecting a single application is typically under $15/month plus request volume.

Common Pitfalls

  1. Forgetting CLOUDFRONT scope must use us-east-1 — a frequent source of "resource not found" errors.
  2. Setting default action to Block without a solid allow list — this breaks the app for every legitimate user until rules are tuned.
  3. Not enabling logging — without AWS WAF logs shipped to S3 or CloudWatch Logs, you can't audit what was blocked or tune false positives.
  4. Running Count mode forever — Managed Rule Groups should be tested in COUNT action before switching to BLOCK in production.

FAQ

Is AWS WAF the same as a network firewall or security group? No. Security groups filter at the network/transport layer (IP and port). AWS WAF inspects the actual HTTP request content — headers, URI, query strings, body — making it effective against application-layer attacks like SQL injection.

Does AWS WAF protect against DDoS attacks? AWS WAF helps with application-layer (Layer 7) floods via rate-based rules, but for comprehensive DDoS protection you should pair it with AWS Shield Advanced.

Can I use AWS WAF with a non-AWS origin server? Yes, if you front that origin with CloudFront or an ALB — the WAF attaches to the AWS resource, not the backend server itself.

How long does it take to deploy AWS WAF rules? Rule changes typically propagate within seconds for ALB/API Gateway and a few minutes for CloudFront due to edge propagation.

Need Help Hardening Your AWS Perimeter?

f9infotech's AWS security team designs, deploys, and tunes WAF rule sets tailored to your application's traffic patterns — from initial Managed Rule Group rollout to custom rate-limiting and bot mitigation. Talk to our AWS security specialists to get a WAF implementation plan built around your actual threat model.