{"id":326,"date":"2026-04-13T16:18:23","date_gmt":"2026-04-13T16:18:23","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/aws-waf-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/"},"modified":"2026-04-13T16:18:23","modified_gmt":"2026-04-13T16:18:23","slug":"aws-waf-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/aws-waf-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/","title":{"rendered":"AWS WAF Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security, identity, and compliance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security, identity, and compliance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>AWS WAF is AWS\u2019s managed web application firewall for protecting HTTP(S) applications from common web exploits and unwanted traffic. You attach AWS WAF to supported entry points\u2014such as Amazon CloudFront distributions, Application Load Balancers (ALB), and Amazon API Gateway REST APIs\u2014and then define rules that allow, block, or monitor requests.<\/p>\n\n\n\n<p>In simple terms: <strong>AWS WAF sits in front of your web app and filters incoming web requests based on rules you control<\/strong> (for example, \u201cblock SQL injection patterns,\u201d \u201crate-limit abusive IPs,\u201d or \u201conly allow certain countries\u201d). You can start with AWS Managed Rules and then add custom rules as you learn your application\u2019s traffic patterns.<\/p>\n\n\n\n<p>Technically, AWS WAF evaluates each incoming HTTP(S) request against a <strong>web ACL<\/strong> (Access Control List) containing ordered rules (custom rules and managed rule groups). Each rule can take actions such as <strong>Allow<\/strong>, <strong>Block<\/strong>, <strong>Count<\/strong>, and (for specific use cases) <strong>CAPTCHA<\/strong> or <strong>Challenge<\/strong>. AWS WAF emits <strong>Amazon CloudWatch metrics<\/strong>, supports <strong>sampled requests<\/strong> for investigation, and can send detailed <strong>WAF logs<\/strong> to <strong>Amazon Kinesis Data Firehose<\/strong> for storage and analysis.<\/p>\n\n\n\n<p>The main problem AWS WAF solves is <strong>reducing application-layer attack surface<\/strong> (L7) and abuse (bots, scraping, credential stuffing patterns, and request floods that are not necessarily volumetric DDoS) while giving teams operational control, visibility, and a pay-as-you-go security layer integrated with AWS services.<\/p>\n\n\n\n<blockquote>\n<p>Service status and naming note: <strong>AWS WAF<\/strong> is the current service. <strong>AWS WAF Classic<\/strong> is the legacy version and should generally be avoided for new deployments. This tutorial focuses on the current AWS WAF (often referenced in APIs\/CLI as <code>wafv2<\/code>). Verify any legacy references in older blogs before following them.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is AWS WAF?<\/h2>\n\n\n\n<p><strong>Official purpose (what it is):<\/strong><br\/>\nAWS WAF is a managed web application firewall that helps protect web applications and APIs against common web exploits that can affect availability, compromise security, or consume excessive resources.<\/p>\n\n\n\n<p><strong>Core capabilities:<\/strong>\n&#8211; Create and manage <strong>web ACLs<\/strong> that evaluate web requests.\n&#8211; Use <strong>AWS Managed Rules<\/strong> and third-party managed rule groups (via AWS Marketplace, where available) to detect common threats.\n&#8211; Build <strong>custom rules<\/strong> (e.g., match IPs, headers, URI paths, query strings, request body patterns).\n&#8211; Apply <strong>rate-based rules<\/strong> to limit repeated requests from the same source.\n&#8211; Improve bot defense using features like <strong>AWS WAF CAPTCHA<\/strong>, <strong>Challenge<\/strong>, and <strong>Bot Control<\/strong> (Bot Control is a paid managed rule group\u2014verify current availability and pricing in official docs).\n&#8211; Monitor via <strong>CloudWatch metrics<\/strong> and investigate via <strong>sampled requests<\/strong> and <strong>WAF logs<\/strong>.<\/p>\n\n\n\n<p><strong>Major components (mental model):<\/strong>\n&#8211; <strong>Web ACL<\/strong>: A container for rules, with a default action (allow\/block).\n&#8211; <strong>Rules<\/strong>: The logic that inspects requests and decides an action.\n&#8211; <strong>Rule groups<\/strong>: Reusable collections of rules (your own or managed).\n&#8211; <strong>Managed rule groups<\/strong>: Curated rules maintained by AWS or sellers.\n&#8211; <strong>IP sets<\/strong>: Lists of IP addresses\/CIDRs to allow\/block.\n&#8211; <strong>Regex pattern sets<\/strong>: Reusable regular expressions for matching.\n&#8211; <strong>Logging configuration<\/strong>: Sends request records to Kinesis Data Firehose.<\/p>\n\n\n\n<p><strong>Service type:<\/strong><br\/>\nA fully managed <strong>Layer 7 (HTTP\/S)<\/strong> firewall and traffic filtering service (not a Layer 3\/4 firewall).<\/p>\n\n\n\n<p><strong>Scope (regional vs global):<\/strong>\n&#8211; AWS WAF supports different scopes depending on what you protect:\n  &#8211; <strong>CloudFront<\/strong>: global edge entry point; AWS WAF uses a <strong>CloudFront scope<\/strong> web ACL (created\/managed in a specific way; commonly requires using the <strong>US East (N. Virginia)<\/strong> control plane region for CloudFront associations\u2014verify in official docs for current behavior).\n  &#8211; <strong>Regional resources<\/strong>: such as <strong>ALB<\/strong> and <strong>API Gateway REST APIs<\/strong>, where the web ACL is <strong>regional<\/strong>.<\/p>\n\n\n\n<p><strong>How it fits into the AWS ecosystem (Security, identity, and compliance):<\/strong>\n&#8211; Complements <strong>AWS Shield<\/strong> (DDoS protection) by focusing on <strong>application-layer filtering<\/strong> rather than volumetric network floods.\n&#8211; Works well with <strong>Amazon CloudFront<\/strong> (edge delivery), <strong>Elastic Load Balancing (ALB)<\/strong>, and <strong>Amazon API Gateway<\/strong> (API front door).\n&#8211; Central governance can be done using <strong>AWS Firewall Manager<\/strong> (especially in AWS Organizations environments) to deploy policies consistently across accounts.\n&#8211; Visibility and investigation integrate with <strong>Amazon CloudWatch<\/strong> (metrics) and <strong>Kinesis Data Firehose<\/strong> destinations (S3\/OpenSearch\/CloudWatch Logs via Firehose capabilities).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use AWS WAF?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce risk of breaches and downtime<\/strong> from common web exploits (e.g., SQL injection, XSS attempts).<\/li>\n<li><strong>Protect revenue and brand<\/strong> by reducing abusive traffic and application unavailability due to request floods.<\/li>\n<li><strong>Improve security posture<\/strong> without operating your own WAF appliances or patching WAF software.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tight integration<\/strong> with AWS entry points (CloudFront, ALB, API Gateway) where TLS is terminated and HTTP requests can be inspected.<\/li>\n<li><strong>Managed rule groups<\/strong> help you start quickly with baseline protections.<\/li>\n<li><strong>Granular match conditions<\/strong> (headers, cookies, query strings, URI path, request body) for custom logic.<\/li>\n<li><strong>Rate limiting<\/strong> to protect login endpoints, search endpoints, or expensive API operations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CloudWatch metrics<\/strong> per rule for quick insight into what is being blocked or counted.<\/li>\n<li><strong>Logging via Firehose<\/strong> enables investigations, dashboards, and alerting pipelines.<\/li>\n<li><strong>Rule testing approach<\/strong> using <code>Count<\/code> action before enforcing <code>Block<\/code> reduces the risk of false positives.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Helps implement layered controls aligned with common security frameworks (e.g., OWASP Top 10 categories).<br\/>\n  It does <strong>not<\/strong> guarantee compliance by itself\u2014compliance depends on your full system and processes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Managed service that scales with request volume at supported front doors.<\/li>\n<li>Works well for high-traffic sites when paired with CloudFront caching and origin protection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose AWS WAF<\/h3>\n\n\n\n<p>Choose AWS WAF when:\n&#8211; You host web applications or APIs behind <strong>CloudFront<\/strong>, <strong>ALB<\/strong>, or <strong>API Gateway<\/strong> and want managed L7 protections.\n&#8211; You need <strong>managed rules<\/strong> plus the ability to add <strong>custom application-specific filters<\/strong>.\n&#8211; You want <strong>centralized governance<\/strong> (Firewall Manager) for multi-account environments.\n&#8211; You need to mitigate abuse such as scraping, bad bots, and request floods at the app layer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose AWS WAF<\/h3>\n\n\n\n<p>AWS WAF may not be the best fit when:\n&#8211; You need <strong>Layer 3\/4 network firewalling<\/strong> (use <strong>AWS Network Firewall<\/strong>, security groups, NACLs, or third-party network firewalls).\n&#8211; Your workload is not HTTP\/S (e.g., raw TCP services).\n&#8211; You need an <strong>inline proxy with full traffic decryption outside of supported AWS front doors<\/strong>\u2014AWS WAF works where AWS terminates TLS and provides request context to WAF.\n&#8211; You require WAF protections for an on-prem endpoint without putting it behind a supported AWS service (you might front it with CloudFront\/ALB or use another approach).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is AWS WAF used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>E-commerce and retail (protect checkout\/login, reduce scraping and carding-like patterns)<\/li>\n<li>SaaS and B2B platforms (API protection, tenant isolation patterns)<\/li>\n<li>Media and content (protect against scraping and abusive requests)<\/li>\n<li>Financial services (login protection, compliance-driven controls)<\/li>\n<li>Healthcare (web portals, API endpoints with strict access patterns)<\/li>\n<li>Education and public sector (protect public portals from common attacks)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security engineering and AppSec teams defining controls and baselines<\/li>\n<li>Platform\/infra teams owning edge and ingress<\/li>\n<li>DevOps\/SRE teams operating metrics, logs, and incident response<\/li>\n<li>Developers adding application-aware allow\/deny logic (e.g., admin portal restrictions)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads and architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Static + dynamic websites behind CloudFront<\/li>\n<li>Microservices behind ALB ingress<\/li>\n<li>Public APIs exposed via API Gateway<\/li>\n<li>Multi-account organizations that need consistent WAF policies<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201cBaseline protections\u201d using AWS Managed Rules for new apps<\/li>\n<li>Strict allowlists for admin endpoints<\/li>\n<li>Rate limiting for authentication endpoints<\/li>\n<li>Geo restrictions for region-locked services (with careful consideration for VPNs and travelers)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dev\/test<\/strong>: run rules in <strong>Count<\/strong> mode, validate false positives, test new rule groups, and tune before enforcement.<\/li>\n<li><strong>Production<\/strong>: enforce <code>Block<\/code>\/<code>CAPTCHA<\/code>\/<code>Challenge<\/code> where appropriate; centralize logs; alert on spikes and anomalous patterns.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where AWS WAF is commonly used. Each use case includes the problem, why AWS WAF fits, and a short example.<\/p>\n\n\n\n<p>1) <strong>Baseline OWASP protections with managed rules<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> New applications ship quickly, often without hardened input validation everywhere.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> AWS Managed Rules can detect common exploit patterns (SQLi\/XSS\/etc.) with minimal setup.<br\/>\n&#8211; <strong>Example:<\/strong> A team launches a new marketing site with dynamic forms behind CloudFront and enables AWS Managed Rules to reduce common injection attempts.<\/p>\n\n\n\n<p>2) <strong>Protect login endpoints from brute force and abuse (rate limiting)<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Attackers repeatedly try credentials, increasing load and lockouts.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Rate-based rules can throttle repeated requests per source IP (and other aggregation keys in supported configurations\u2014verify in official docs).<br\/>\n&#8211; <strong>Example:<\/strong> <code>\/login<\/code> requests over a threshold trigger a block for a period.<\/p>\n\n\n\n<p>3) <strong>Block known-bad IPs and allow trusted IPs<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Persistent attacks originate from known IP ranges; admins need limited access.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> IP sets allow allowlist\/denylist controls and quick incident response updates.<br\/>\n&#8211; <strong>Example:<\/strong> Only corporate VPN IP ranges can access <code>\/admin<\/code>.<\/p>\n\n\n\n<p>4) <strong>Geographic restrictions (geo match)<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> A service is legally available only in certain countries.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Geo match rules can block or allow based on country.<br\/>\n&#8211; <strong>Example:<\/strong> Block traffic outside permitted regions, with documented exceptions for business travelers via VPN.<\/p>\n\n\n\n<p>5) <strong>Block malicious user agents and scanners<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Automated scanners probe endpoints and waste resources.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Header inspection and regex pattern sets can match suspicious <code>User-Agent<\/code> strings.<br\/>\n&#8211; <strong>Example:<\/strong> Block requests with user agents matching common scanner signatures (careful: user agents are spoofable).<\/p>\n\n\n\n<p>6) <strong>Reduce impact of scraping and content harvesting<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Scrapers overload search\/product pages and copy content.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Combine rate limits, bot control (if used), and header\/cookie patterns.<br\/>\n&#8211; <strong>Example:<\/strong> High request frequency with missing session cookies triggers <code>Challenge<\/code>.<\/p>\n\n\n\n<p>7) <strong>Protect expensive endpoints (search, reports, exports)<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Certain endpoints are costly, and abuse spikes costs.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Rate limits, size constraints, and pattern matches reduce abusive traffic.<br\/>\n&#8211; <strong>Example:<\/strong> Block requests with extremely large query strings and rate-limit <code>\/export<\/code>.<\/p>\n\n\n\n<p>8) <strong>Virtual patching for urgent vulnerabilities<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> A new web framework vulnerability emerges; patching app code takes time.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Temporary rules can block exploit patterns at the edge\/ingress.<br\/>\n&#8211; <strong>Example:<\/strong> Block a specific malicious URI\/query pattern associated with the CVE while application teams patch and roll out.<\/p>\n\n\n\n<p>9) <strong>API abuse control for public APIs<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Public APIs get hammered by clients or abusive automation.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Attach WAF to API Gateway REST APIs and enforce request filters and rate-based rules.<br\/>\n&#8211; <strong>Example:<\/strong> Rate-limit <code>\/v1\/search<\/code> and block malformed JSON (within WAF inspection capabilities\u2014verify exact behavior in docs).<\/p>\n\n\n\n<p>10) <strong>Tenant\/partner isolation controls at the edge<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Partners should only access specific paths or hostnames.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Match <code>Host<\/code> header and URI path patterns to restrict access.<br\/>\n&#8211; <strong>Example:<\/strong> Only requests with <code>Host: partner.example.com<\/code> can access <code>\/partner\/*<\/code>.<\/p>\n\n\n\n<p>11) <strong>Staged deployment of security controls using Count<\/strong><br\/>\n&#8211; <strong>Problem:<\/strong> Enabling strict WAF rules can break legitimate traffic.<br\/>\n&#8211; <strong>Why AWS WAF fits:<\/strong> Use <code>Count<\/code> for observability first, then enforce <code>Block<\/code> after tuning.<br\/>\n&#8211; <strong>Example:<\/strong> Run managed rules in Count for a week, review sampled requests\/logs, then convert high-confidence detections to Block.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>This section focuses on current, commonly used AWS WAF capabilities. If you need a capability not listed here, verify in official docs because AWS WAF evolves frequently.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Web ACLs (Access Control Lists)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Defines a set of rules and a default action to apply to web requests for a protected resource.  <\/li>\n<li><strong>Why it matters:<\/strong> It\u2019s the unit you attach to CloudFront\/ALB\/API Gateway.  <\/li>\n<li><strong>Practical benefit:<\/strong> Central place to manage \u201callow\/block\/count\u201d logic.  <\/li>\n<li><strong>Caveats:<\/strong> CloudFront and regional resources use different scopes; ensure you create the correct web ACL type.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Rules and rule priority (ordered evaluation)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Evaluates rules in order of priority. A terminating action (e.g., Block\/Allow\/CAPTCHA\/Challenge) stops evaluation.  <\/li>\n<li><strong>Why it matters:<\/strong> Rule order determines outcomes when multiple rules could match.  <\/li>\n<li><strong>Practical benefit:<\/strong> Put high-confidence allow\/deny rules early; use Count rules for investigation without disruption.  <\/li>\n<li><strong>Caveats:<\/strong> Misordered rules can cause unexpected blocks or allow bypasses.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">AWS Managed Rules<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides curated rule groups maintained by AWS for common threats.  <\/li>\n<li><strong>Why it matters:<\/strong> Faster time-to-protection than writing everything yourself.  <\/li>\n<li><strong>Practical benefit:<\/strong> Standard baseline protection aligned with common exploit classes.  <\/li>\n<li><strong>Caveats:<\/strong> Managed rules can have false positives; start in Count mode and tune (e.g., rule exclusions) where supported.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Custom rules (match statements)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows matching on parts of HTTP requests (IP, headers, URI path, query string, body, etc.).  <\/li>\n<li><strong>Why it matters:<\/strong> You can encode application-specific policy.  <\/li>\n<li><strong>Practical benefit:<\/strong> Protect admin paths, block known attack patterns specific to your app.  <\/li>\n<li><strong>Caveats:<\/strong> Avoid overly broad regex; it can increase false positives and operational overhead.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IP sets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Stores lists of IP addresses\/CIDRs used in rules.  <\/li>\n<li><strong>Why it matters:<\/strong> Enables quick response to abuse and structured allowlists.  <\/li>\n<li><strong>Practical benefit:<\/strong> Central, reusable list of trusted corporate IP ranges.  <\/li>\n<li><strong>Caveats:<\/strong> IP-based controls are less effective against distributed attacks, NATed clients, and botnets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regex pattern sets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you define reusable regex patterns for request matching.  <\/li>\n<li><strong>Why it matters:<\/strong> Useful for consistent matching across multiple rules.  <\/li>\n<li><strong>Practical benefit:<\/strong> Maintain one set for admin path patterns used by multiple web ACLs.  <\/li>\n<li><strong>Caveats:<\/strong> Regex can be complex and error-prone; test and keep patterns maintainable.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Rate-based rules (rate limiting)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Detects and optionally blocks requests that exceed a defined rate threshold.  <\/li>\n<li><strong>Why it matters:<\/strong> Helps mitigate brute force, scraping, and abusive clients.  <\/li>\n<li><strong>Practical benefit:<\/strong> Reduce load on authentication and search endpoints.  <\/li>\n<li><strong>Caveats:<\/strong> Rate limiting by IP can impact shared NATs (e.g., corporate networks). Also, attackers can distribute traffic across many IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CAPTCHA and Challenge<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Presents CAPTCHA or a challenge to help confirm a request is from a legitimate client rather than automation (implementation details vary\u2014verify in official docs).  <\/li>\n<li><strong>Why it matters:<\/strong> Offers a middle ground between allow and block.  <\/li>\n<li><strong>Practical benefit:<\/strong> Let humans through while slowing bots.  <\/li>\n<li><strong>Caveats:<\/strong> Adds UX friction and may affect accessibility; carefully scope where used (e.g., suspicious traffic only).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Bot Control (managed)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> A managed rule group aimed at detecting and managing bot traffic.  <\/li>\n<li><strong>Why it matters:<\/strong> Bots are a major source of application abuse.  <\/li>\n<li><strong>Practical benefit:<\/strong> Better bot signals than simple user-agent blocking.  <\/li>\n<li><strong>Caveats:<\/strong> Typically incurs additional cost and may require tuning. Verify current pricing and capabilities.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Custom responses<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Customize the HTTP status code and response body for blocked requests (supported contexts vary; verify in official docs).  <\/li>\n<li><strong>Why it matters:<\/strong> Improves UX and troubleshooting for legitimate users.  <\/li>\n<li><strong>Practical benefit:<\/strong> Show \u201cRequest blocked\u201d with a support code or link.  <\/li>\n<li><strong>Caveats:<\/strong> Be careful not to leak security details.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CloudWatch metrics and sampled requests<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Exposes per-rule metrics and sample request details for investigation.  <\/li>\n<li><strong>Why it matters:<\/strong> You need visibility to tune and operate WAF.  <\/li>\n<li><strong>Practical benefit:<\/strong> Quickly identify which rule blocks traffic and why.  <\/li>\n<li><strong>Caveats:<\/strong> Sampled requests are limited; for full-fidelity analysis enable WAF logging.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Logging via Kinesis Data Firehose<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Sends detailed WAF request logs to a Firehose delivery stream for storage\/analysis.  <\/li>\n<li><strong>Why it matters:<\/strong> Enables forensics, dashboards, and detection engineering.  <\/li>\n<li><strong>Practical benefit:<\/strong> Store logs in S3 and query via Athena, or stream to analytics.  <\/li>\n<li><strong>Caveats:<\/strong> Additional costs for Firehose, storage, and queries; ensure data retention and access control.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Central management via AWS Firewall Manager<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you define and apply WAF policies across multiple accounts\/resources in AWS Organizations.  <\/li>\n<li><strong>Why it matters:<\/strong> Standardization and governance at scale.  <\/li>\n<li><strong>Practical benefit:<\/strong> Apply baseline managed rules across all ALBs in all accounts.  <\/li>\n<li><strong>Caveats:<\/strong> Requires Organizations setup; changes affect many apps\u2014use change control.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>AWS WAF works by attaching a web ACL to a supported resource. Incoming HTTP(S) requests are evaluated against the web ACL rules. Depending on the first matching terminating rule action (or the default action), requests are allowed to reach your origin or are blocked\/challenged.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane (configuration):<\/strong>\n  1. You create a <strong>web ACL<\/strong> and add rules\/rule groups.\n  2. You <strong>associate<\/strong> the web ACL with CloudFront\/ALB\/API Gateway.\n  3. Optionally configure <strong>logging<\/strong> to a <strong>Kinesis Data Firehose<\/strong> stream.<\/li>\n<li><strong>Data plane (traffic):<\/strong>\n  1. Client sends HTTP(S) request to CloudFront\/ALB\/API Gateway.\n  2. AWS WAF evaluates the request against rules (in priority order).\n  3. If allowed, request proceeds to the origin (ALB target\/ECS\/EKS\/EC2\/Lambda\/API backend).\n  4. Metrics are emitted to CloudWatch; sampled requests and\/or logs are recorded.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations include:\n&#8211; <strong>Amazon CloudFront<\/strong>: Edge distribution + WAF web ACL for global web properties.\n&#8211; <strong>Elastic Load Balancing (Application Load Balancer)<\/strong>: Regional ingress for apps in VPC.\n&#8211; <strong>Amazon API Gateway (REST APIs)<\/strong>: Protect public API endpoints (verify exact API types supported in your region).\n&#8211; <strong>Amazon CloudWatch<\/strong>: Metrics and alarms.\n&#8211; <strong>Amazon Kinesis Data Firehose<\/strong>: WAF logging delivery to destinations like S3\/OpenSearch (destination support depends on Firehose features in your region).\n&#8211; <strong>AWS Firewall Manager<\/strong>: Central policy management across accounts.\n&#8211; <strong>AWS Shield<\/strong>: Complementary DDoS protection (Shield Standard is enabled by default on some AWS services; Shield Advanced is optional and paid).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For CloudFront protection, you\u2019ll have a <strong>CloudFront distribution<\/strong>.<\/li>\n<li>For ALB protection, an <strong>ALB<\/strong> in a VPC and targets.<\/li>\n<li>For logging, <strong>Kinesis Data Firehose<\/strong> and a destination like <strong>S3<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF uses <strong>AWS IAM<\/strong> for management actions (create\/update web ACLs, rule groups, logging config).<\/li>\n<li>Use least privilege and separate roles for:<\/li>\n<li>WAF administrators (policy management)<\/li>\n<li>Security operations (read-only + log access)<\/li>\n<li>CI\/CD automation (scoped update permissions)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF is not deployed into your VPC as a traditional appliance.<\/li>\n<li>It evaluates requests at the supported service boundary (CloudFront edge locations or regional front doors like ALB\/API Gateway).<\/li>\n<li>TLS is typically terminated at CloudFront\/ALB\/API Gateway; WAF inspects the HTTP request after termination in that flow.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>CloudWatch metrics<\/strong> for:<\/li>\n<li>Allowed vs blocked requests<\/li>\n<li>Rule match counts<\/li>\n<li>Sudden spikes (possible attacks)<\/li>\n<li>Use <strong>WAF logs<\/strong> for:<\/li>\n<li>Root cause analysis<\/li>\n<li>False positive tuning<\/li>\n<li>Security analytics and threat hunting<\/li>\n<li>Use <strong>tagging<\/strong> for web ACLs, IP sets, and Firehose\/S3 resources to track cost and ownership.<\/li>\n<li>In multi-account setups, consider <strong>Firewall Manager<\/strong> and centralized logging to a security account.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[Users \/ Clients] --&gt; CF[Amazon CloudFront]\n  CF --&gt; WAF[AWS WAF Web ACL]\n  WAF --&gt; ORIGIN[Origin: ALB or S3 or API]\n  WAF --&gt; CW[Amazon CloudWatch Metrics]\n  WAF --&gt; FH[Kinesis Data Firehose (optional logs)]\n  FH --&gt; S3[Amazon S3 (log storage)]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Internet\n    U[Users]\n    B[Bad Bots \/ Attackers]\n  end\n\n  U --&gt; CF[CloudFront Distribution]\n  B --&gt; CF\n\n  CF --&gt; WAF[AWS WAF (CloudFront scope Web ACL)]\n  WAF --&gt;|Allow| ALB[Application Load Balancer]\n  WAF --&gt;|Block\/CAPTCHA\/Challenge| RESP[WAF Response]\n\n  ALB --&gt; EKS[EKS\/ECS\/EC2 App Tier]\n  EKS --&gt; DB[(Database)]\n  EKS --&gt; CACHE[(Cache)]\n\n  WAF --&gt; CW[CloudWatch Metrics + Alarms]\n  WAF --&gt; FH[Kinesis Data Firehose (WAF Logs)]\n  FH --&gt; S3[Central S3 Bucket (Security Account)]\n  S3 --&gt; ATH[Athena Queries]\n  S3 --&gt; SIEM[SIEM \/ Analytics (optional)]\n\n  subgraph Governance\n    FMS[AWS Firewall Manager (optional)]\n    ORG[AWS Organizations]\n  end\n\n  ORG --&gt; FMS\n  FMS --&gt; WAF\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before starting the lab, ensure you have:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Account and billing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>AWS account<\/strong> with billing enabled.<\/li>\n<li>Awareness that CloudFront, AWS WAF, Firehose, and S3 may incur charges (even at low usage).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM<\/h3>\n\n\n\n<p>For a beginner lab, the simplest path is using an administrator-like role. For a least-privilege approach, you typically need permissions for:\n&#8211; <code>wafv2:*<\/code> (or scoped create\/update for web ACLs, rule groups, IP sets, logging)\n&#8211; <code>cloudfront:*<\/code> (create\/update distribution, associate WAF)\n&#8211; <code>s3:*<\/code> (create bucket, store logs)\n&#8211; <code>firehose:*<\/code> (create delivery stream)\n&#8211; <code>iam:CreateRole<\/code>, <code>iam:PassRole<\/code> (for Firehose to write to S3)<\/p>\n\n\n\n<p>In production, split duties:\n&#8211; Security team manages WAF policies.\n&#8211; Platform team manages CloudFront\/ALB\/API Gateway attachments.\n&#8211; Observability team manages log pipelines.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Management Console access<\/li>\n<li>Optional: <strong>AWS CLI v2<\/strong> installed and configured:<\/li>\n<li>https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/getting-started-install.html<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF is available in many regions, but <strong>scope matters<\/strong>:<\/li>\n<li><strong>CloudFront scope<\/strong> web ACLs have specific association behavior (commonly controlled in <strong>us-east-1<\/strong>). Verify current requirement in official docs.<\/li>\n<li>Regional web ACLs are created in the same region as your ALB\/API.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas \/ limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF has quotas on web ACLs, rules, rule groups, IP set sizes, etc.<\/li>\n<li>Check <strong>Service Quotas<\/strong>:<\/li>\n<li>AWS Console \u2192 Service Quotas \u2192 AWS WAF<br\/>\n  Quotas change over time; don\u2019t rely on old blog numbers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services for this lab<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Amazon S3 (for a simple origin and for logs)<\/li>\n<li>Amazon CloudFront (as the protected front door)<\/li>\n<li>Kinesis Data Firehose (for WAF logs)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>AWS WAF pricing is <strong>usage-based<\/strong>. Exact amounts vary by region and can change, so always verify on the official pricing page.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing references<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF pricing: https:\/\/aws.amazon.com\/waf\/pricing\/  <\/li>\n<li>AWS Pricing Calculator: https:\/\/calculator.aws\/#\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (typical model)<\/h3>\n\n\n\n<p>AWS WAF commonly charges based on:\n&#8211; <strong>Number of web ACLs<\/strong> you create\/use\n&#8211; <strong>Number of rules<\/strong> (and\/or rule groups) in the web ACL\n&#8211; <strong>Number of web requests<\/strong> processed by the web ACL\n&#8211; <strong>Managed rule groups<\/strong>: some are included in the base model; others (e.g., advanced bot protections or marketplace rule groups) may have <strong>additional fees<\/strong>. Verify current pricing and which managed groups incur extra charges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>AWS WAF generally does <strong>not<\/strong> have a broad \u201calways-free\u201d tier comparable to some other AWS services. Some accounts may have promotional credits, but do not assume WAF is free. Verify in the pricing page and your account\u2019s free tier dashboard.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers<\/h3>\n\n\n\n<p>Direct cost drivers:\n&#8211; High request volume at CloudFront\/ALB\/API Gateway\n&#8211; Large number of enabled rules and managed rule groups\n&#8211; Paid managed rule groups (e.g., bot-related add-ons)<\/p>\n\n\n\n<p>Indirect\/hidden cost drivers:\n&#8211; <strong>Kinesis Data Firehose<\/strong> costs for log ingestion and delivery\n&#8211; <strong>S3<\/strong> storage for logs and lifecycle retention\n&#8211; <strong>Athena<\/strong> query costs if you analyze logs frequently\n&#8211; <strong>CloudWatch<\/strong> costs if you export logs to CloudWatch Logs or create many alarms\/dashboards\n&#8211; CloudFront and origin costs (data transfer and requests)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF itself is applied at the front door; it doesn\u2019t add separate data transfer line items the way a proxy might.<\/li>\n<li><strong>CloudFront<\/strong> and your origin services still incur their usual request\/data transfer costs.<\/li>\n<li>WAF logs delivered to S3 will increase storage and query traffic.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>a small number of high-value rules<\/strong> (managed baseline + one or two custom rules).<\/li>\n<li>Use <strong>Count mode<\/strong> strategically, but avoid leaving noisy Count rules indefinitely in production if they encourage unnecessary rule evaluations.<\/li>\n<li>Reduce log volume:<\/li>\n<li>Log only what you need (AWS WAF logging is typically \u201call requests evaluated by WAF\u201d; if you need sampling or filtering, do it downstream).<\/li>\n<li>Apply S3 lifecycle policies to move logs to cheaper storage or expire.<\/li>\n<li>Use CloudFront caching and origin protection to reduce expensive origin hits (separate from WAF cost, but improves overall cost posture).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (conceptual)<\/h3>\n\n\n\n<p>A small demo setup might include:\n&#8211; 1 CloudFront distribution with 1 web ACL\n&#8211; A small number of rules (e.g., one managed rule group + one custom rule + one rate-based rule)\n&#8211; Low traffic volume (developer testing)\n&#8211; Optional logging to S3 via Firehose for a limited period<\/p>\n\n\n\n<p>To estimate:\n1. Use the AWS Pricing Calculator.\n2. Add AWS WAF usage: web ACL count, rule count, and request volume.\n3. Add CloudFront request\/data transfer, S3 storage, Firehose ingestion.<\/p>\n\n\n\n<p>Because prices vary and change, <strong>do not copy numbers from blogs<\/strong>\u2014use the calculator for your region and expected volume.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs are typically driven by:\n&#8211; Large request volumes (especially on busy consumer sites)\n&#8211; Multiple web ACLs across environments\/accounts\n&#8211; Several managed rule groups (some may be paid add-ons)\n&#8211; Centralized logging at scale (Firehose + S3 + analytics)<\/p>\n\n\n\n<p>A practical approach is to:\n&#8211; Baseline costs with WAF metrics and request volume.\n&#8211; Run a proof-of-value with logs for a few weeks.\n&#8211; Right-size rules and retention once you know typical attack patterns.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab builds a real, small setup: <strong>CloudFront + S3 origin protected by AWS WAF<\/strong>, including one custom block rule, one rate-based rule, and optional logging to S3 via Firehose.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create an AWS WAF <strong>web ACL (CloudFront scope)<\/strong>.<\/li>\n<li>Add:<\/li>\n<li>A <strong>custom rule<\/strong> that blocks a known test query string (<code>bad=1<\/code>)<\/li>\n<li>A <strong>rate-based rule<\/strong> to mitigate bursts from a single IP<\/li>\n<li>(Optional but recommended) an <strong>AWS Managed Rule group<\/strong> in <code>Count<\/code> mode for safe evaluation<\/li>\n<li>Associate the web ACL with a <strong>CloudFront distribution<\/strong> that serves content from <strong>S3<\/strong>.<\/li>\n<li>Validate that:<\/li>\n<li>Normal requests succeed<\/li>\n<li>Requests matching the rule are blocked<\/li>\n<li>Metrics\/logs show the activity<\/li>\n<li>Clean up all resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will create:\n&#8211; 1 S3 bucket with a simple <code>index.html<\/code>\n&#8211; 1 CloudFront distribution with the S3 bucket as origin\n&#8211; 1 AWS WAF web ACL (CloudFront scope) attached to the distribution\n&#8211; (Optional) 1 Kinesis Data Firehose stream + S3 bucket\/prefix for WAF logs<\/p>\n\n\n\n<p>Estimated time: 45\u201390 minutes (CloudFront propagation and deletion can add time).<br\/>\nCost: low for brief testing, but <strong>not free<\/strong>\u2014AWS WAF and CloudFront may incur charges.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create an S3 bucket with a simple page (origin)<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Create a stable origin for CloudFront.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>Amazon S3<\/strong> console.<\/li>\n<li>Create a bucket (globally unique name), for example:\n   &#8211; <code>my-waf-lab-origin-&lt;random-suffix&gt;<\/code><\/li>\n<li>Keep <strong>Block Public Access<\/strong> enabled (recommended).<\/li>\n<li>Upload a simple <code>index.html<\/code> file.<\/li>\n<\/ol>\n\n\n\n<p>Example <code>index.html<\/code>:<\/p>\n\n\n\n<pre><code class=\"language-html\">&lt;!doctype html&gt;\n&lt;html&gt;\n  &lt;head&gt;&lt;title&gt;AWS WAF Lab&lt;\/title&gt;&lt;\/head&gt;\n  &lt;body&gt;\n    &lt;h1&gt;AWS WAF Lab OK&lt;\/h1&gt;\n    &lt;p&gt;If you can see this, CloudFront is working.&lt;\/p&gt;\n  &lt;\/body&gt;\n&lt;\/html&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Bucket exists with <code>index.html<\/code> uploaded.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In S3 console, confirm the object is present.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a CloudFront distribution pointing to S3<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Create the HTTP(S) front door that AWS WAF will protect.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>Amazon CloudFront<\/strong> console \u2192 <strong>Create distribution<\/strong>.<\/li>\n<li><strong>Origin domain<\/strong>: select your S3 bucket (the REST endpoint origin, not \u201cS3 website hosting\u201d unless you intentionally need it).<\/li>\n<li><strong>Origin access<\/strong>:\n   &#8211; Use <strong>Origin Access Control (OAC)<\/strong> if the console offers it (recommended).\n   &#8211; If you choose OAC, allow CloudFront to access the bucket by applying the generated bucket policy.<\/li>\n<li><strong>Default root object<\/strong>: set to <code>index.html<\/code>.<\/li>\n<li>Leave other settings at defaults unless you have requirements.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> CloudFront distribution is created and begins deploying.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Wait until the distribution status is <strong>Deployed<\/strong>.\n&#8211; Copy the distribution domain name (e.g., <code>d123abcd.cloudfront.net<\/code>).\n&#8211; Test:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I https:\/\/d123abcd.cloudfront.net\/\n<\/code><\/pre>\n\n\n\n<p>You should see <code>HTTP\/2 200<\/code> (or <code>HTTP\/1.1 200<\/code> depending on curl\/TLS) after it is fully deployed.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create an AWS WAF web ACL (CloudFront scope)<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Define the firewall policy.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>AWS WAF<\/strong> console.<\/li>\n<li>Choose <strong>Web ACLs<\/strong> \u2192 <strong>Create web ACL<\/strong>.<\/li>\n<li><strong>Name<\/strong>: <code>waf-lab-cloudfront-acl<\/code><\/li>\n<li><strong>Resource type<\/strong>: choose <strong>CloudFront distributions<\/strong> (CloudFront scope).\n   &#8211; Important: CloudFront-scope WAF configuration may require using a specific region for management (commonly <strong>N. Virginia \/ us-east-1<\/strong>). If the console prompts you, follow it. If unsure, <strong>verify in official docs<\/strong>.<\/li>\n<li><strong>Default action<\/strong>: <strong>Allow<\/strong> (we\u2019ll explicitly block only what we want).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A web ACL exists with default allow.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Add a custom rule to block a test query string<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Add a deterministic, easy-to-test rule.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In your web ACL, add a rule named: <code>BlockBadQueryString<\/code><\/li>\n<li>Rule type: <strong>Rule builder<\/strong><\/li>\n<li>Statement:\n   &#8211; Match request <strong>Query string<\/strong> (or a specific query argument if you prefer)\n   &#8211; Condition: contains <code>bad=1<\/code><br\/>\n   (Exact UI options differ; choose the closest match like \u201cQuery string contains\u201d.)<\/li>\n<li>Action: <strong>Block<\/strong><\/li>\n<li>(Optional) Configure a <strong>custom response<\/strong>:\n   &#8211; Response code: <code>403<\/code>\n   &#8211; Response body: <code>\"Blocked by AWS WAF lab rule: bad query string\"<\/code>\n   &#8211; Add <code>Content-Type: text\/plain<\/code><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Requests containing <code>bad=1<\/code> in the query string will be blocked.<\/p>\n\n\n\n<p><strong>Verification (later):<\/strong> You\u2019ll test with curl after association.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Add a rate-based rule to mitigate bursts<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Demonstrate a practical abuse control.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Add a rule named: <code>RateLimitPerIP<\/code><\/li>\n<li>Rule type: <strong>Rate-based rule<\/strong><\/li>\n<li>Rate limit:\n   &#8211; Choose a small number suitable for a lab (for example, tens or low hundreds within the rule\u2019s evaluation window).<br\/>\n   &#8211; <strong>Do not set it too low<\/strong> or you may block yourself while testing.<\/li>\n<li>Scope-down statement (optional but recommended):\n   &#8211; Apply only to a path like <code>\/<\/code> for the lab, or to <code>\/login<\/code> in a real app.<\/li>\n<li>Action: <strong>Block<\/strong> (or <code>Count<\/code> first, if you want to test non-disruptively)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Bursty traffic from a single IP gets blocked once threshold is exceeded.<\/p>\n\n\n\n<p><strong>Verification (later):<\/strong> You\u2019ll generate repeated requests and observe blocks\/metrics.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6 (Optional): Add an AWS Managed Rule group in Count mode<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Show safe evaluation and observability.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Add a rule: <code>AWSManagedCommonRuleSetCount<\/code><\/li>\n<li>Select <strong>Add managed rule groups<\/strong> \u2192 choose an AWS Managed Rule group such as <strong>Core rule set \/ Common protections<\/strong> (names vary slightly in the console).<\/li>\n<li>Override action: <strong>Count<\/strong> (so it won\u2019t block; it will just record matches)<\/li>\n<li>Enable visibility (metrics) for this rule.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You\u2019ll see matches in metrics without blocking legitimate traffic.<\/p>\n\n\n\n<p><strong>Why Count helps:<\/strong> You can observe how often your real traffic triggers managed rules before turning on blocking.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Associate the web ACL with your CloudFront distribution<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Put AWS WAF in the request path.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the AWS WAF web ACL, go to <strong>Associations<\/strong> (or during creation, choose the resource).<\/li>\n<li>Select your CloudFront distribution and associate.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The web ACL is associated with CloudFront.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In WAF console, confirm the associated resource shows the CloudFront distribution.\n&#8211; Note: It may take several minutes for propagation.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8 (Recommended): Enable AWS WAF logging to S3 via Kinesis Data Firehose<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Capture detailed request records for investigation.<\/p>\n\n\n\n<p>High-level flow: AWS WAF \u2192 Kinesis Data Firehose \u2192 S3<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create an S3 bucket for logs, e.g.:\n   &#8211; <code>my-waf-lab-logs-&lt;random-suffix&gt;<\/code><\/li>\n<li>Open <strong>Kinesis Data Firehose<\/strong> console \u2192 create a delivery stream:\n   &#8211; Source: <strong>Direct PUT<\/strong> (WAF will deliver to Firehose)\n   &#8211; Destination: <strong>Amazon S3<\/strong>\n   &#8211; Choose your log bucket and a prefix like <code>waf-logs\/<\/code>\n   &#8211; Configure buffering defaults (fine for lab)\n   &#8211; Create or select an IAM role that allows Firehose to write to the bucket<\/li>\n<li>Back in <strong>AWS WAF<\/strong> console:\n   &#8211; Web ACL \u2192 <strong>Logging and metrics<\/strong>\n   &#8211; Enable logging\n   &#8211; Select your Firehose delivery stream<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> WAF logs begin landing in S3 (often within minutes after traffic occurs).<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Browse the S3 log bucket prefix and confirm objects are being written after you generate traffic.\n&#8211; If you don\u2019t see logs, check IAM role permissions and Firehose delivery errors.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Generate test traffic and confirm blocking works<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Confirm the rules work as intended.<\/p>\n\n\n\n<p>Replace <code>DISTRIBUTION_DOMAIN<\/code> with your CloudFront domain name.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Test A: Normal request (should be allowed)<\/h4>\n\n\n\n<pre><code class=\"language-bash\">curl -i https:\/\/DISTRIBUTION_DOMAIN\/\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> <code>200 OK<\/code> and the HTML content.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Test B: Trigger the custom query-string block (should be blocked)<\/h4>\n\n\n\n<pre><code class=\"language-bash\">curl -i \"https:\/\/DISTRIBUTION_DOMAIN\/?bad=1\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> <code>403 Forbidden<\/code> (or your configured custom response code\/body).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Test C: Trigger the rate-based rule (may block after threshold)<\/h4>\n\n\n\n<p>Run a burst of requests (adjust counts so you don\u2019t accidentally lock yourself out too long):<\/p>\n\n\n\n<pre><code class=\"language-bash\">for i in $(seq 1 200); do\n  curl -s -o \/dev\/null -w \"%{http_code}\\n\" \"https:\/\/DISTRIBUTION_DOMAIN\/?test=$i\"\ndone\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Initially <code>200<\/code>, then some <code>403<\/code> once the threshold is exceeded (if your rate limit is low enough and propagation is complete).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use multiple validation methods:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Browser validation<\/strong>\n&#8211; Open <code>https:\/\/DISTRIBUTION_DOMAIN\/<\/code> and confirm the page loads.\n&#8211; Open <code>https:\/\/DISTRIBUTION_DOMAIN\/?bad=1<\/code> and confirm it is blocked.<\/p>\n<\/li>\n<li>\n<p><strong>AWS WAF CloudWatch metrics<\/strong>\n&#8211; In the WAF web ACL view, check <strong>Metrics<\/strong>:\n  &#8211; Look for increases in <code>BlockedRequests<\/code> for <code>BlockBadQueryString<\/code>.\n  &#8211; Look for <code>CountedRequests<\/code> for the managed rule group (if you enabled Count).<\/p>\n<\/li>\n<li>\n<p><strong>Sampled requests<\/strong>\n&#8211; In the rule view, check <strong>Sampled requests<\/strong> (if available) to see example matching requests.<\/p>\n<\/li>\n<li>\n<p><strong>Logs in S3 (if enabled)<\/strong>\n&#8211; Confirm log objects exist in <code>s3:\/\/my-waf-lab-logs-...\/waf-logs\/<\/code>\n&#8211; Download one log file and inspect fields such as action, terminating rule, URI, query args, and client IP.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and practical fixes:<\/p>\n\n\n\n<p>1) <strong>CloudFront association doesn\u2019t appear \/ wrong region<\/strong>\n&#8211; Symptom: You can\u2019t find your web ACL for CloudFront or association fails.\n&#8211; Fix: CloudFront-scope web ACLs have special handling. Ensure you\u2019re in the correct console region\/view as required. <strong>Verify in AWS WAF docs<\/strong> for CloudFront scope behavior.<\/p>\n\n\n\n<p>2) <strong>You\u2019re not getting blocked even with <code>?bad=1<\/code><\/strong>\n&#8211; Check:\n  &#8211; Is the web ACL definitely associated with the distribution?\n  &#8211; Has CloudFront finished propagating changes? (Wait several minutes.)\n  &#8211; Is the rule priority correct (is there an Allow rule earlier that terminates evaluation)?\n  &#8211; Are you matching the correct request component (query string vs specific query parameter)?\n&#8211; Fix: Move the block rule to a higher priority (earlier) and re-test.<\/p>\n\n\n\n<p>3) <strong>Rate-based rule never triggers<\/strong>\n&#8211; Check:\n  &#8211; Is your threshold too high for your test volume?\n  &#8211; Did you scope-down to a path that your requests don\u2019t hit?\n&#8211; Fix: Lower the threshold for the lab or remove scope-down temporarily.<\/p>\n\n\n\n<p>4) <strong>Firehose logging not delivering<\/strong>\n&#8211; Symptom: No logs appear in S3.\n&#8211; Check:\n  &#8211; Firehose delivery stream status and error logs in the Firehose console.\n  &#8211; IAM role permissions for Firehose to write to S3 (<code>s3:PutObject<\/code>, KMS permissions if bucket uses SSE-KMS).\n&#8211; Fix: Update the role policy, ensure bucket policy allows the role, and retry.<\/p>\n\n\n\n<p>5) <strong>AccessDenied errors during setup<\/strong>\n&#8211; Symptom: Console shows permission errors.\n&#8211; Fix: Use a role with sufficient permissions for the lab, or explicitly grant WAF\/CloudFront\/S3\/Firehose\/IAM permissions needed.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing costs, delete resources in a safe order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Disassociate AWS WAF from CloudFront<\/strong>\n   &#8211; CloudFront distribution \u2192 Security\/WAF settings \u2192 remove web ACL association (exact UI varies).<\/p>\n<\/li>\n<li>\n<p><strong>Delete WAF logging configuration<\/strong>\n   &#8211; AWS WAF web ACL \u2192 Logging and metrics \u2192 disable logging.<\/p>\n<\/li>\n<li>\n<p><strong>Delete AWS WAF resources<\/strong>\n   &#8211; Delete the web ACL (and any IP sets\/regex sets you created).<\/p>\n<\/li>\n<li>\n<p><strong>Delete Firehose delivery stream<\/strong>\n   &#8211; Kinesis Data Firehose \u2192 delete the stream.<\/p>\n<\/li>\n<li>\n<p><strong>Delete S3 log bucket<\/strong>\n   &#8211; Empty bucket first, then delete.<\/p>\n<\/li>\n<li>\n<p><strong>Delete CloudFront distribution<\/strong>\n   &#8211; Disable distribution first, wait for status to deploy, then delete.\n   &#8211; This can take time.<\/p>\n<\/li>\n<li>\n<p><strong>Delete S3 origin bucket<\/strong>\n   &#8211; Empty and delete the bucket.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> No WAF, CloudFront, Firehose, or S3 buckets remain from the lab.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Put AWS WAF at <strong>the earliest practical HTTP entry point<\/strong>:<\/li>\n<li>Use CloudFront + WAF for global sites.<\/li>\n<li>Use ALB + WAF for regional apps.<\/li>\n<li>Use <strong>defense in depth<\/strong>:<\/li>\n<li>Combine WAF with secure coding, authentication\/authorization, Shield for DDoS, and least-privilege IAM.<\/li>\n<li>Protect origins:<\/li>\n<li>Use CloudFront OAC\/OAI for S3 origins.<\/li>\n<li>Restrict ALB origins to CloudFront where appropriate (origin protection patterns).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least privilege IAM policies for WAF management:<\/li>\n<li>Separate \u201cWAF policy admin\u201d from \u201cWAF read-only investigator\u201d.<\/li>\n<li>Control who can:<\/li>\n<li>Associate\/disassociate web ACLs (high impact)<\/li>\n<li>Change managed rules from Count \u2192 Block<\/li>\n<li>In organizations, consider <strong>Firewall Manager<\/strong> to prevent drift.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid enabling many expensive managed protections without a plan.<\/li>\n<li>Use <code>Count<\/code> for evaluation, then disable noisy rules.<\/li>\n<li>Enable logging thoughtfully; apply S3 lifecycle policies and limit query frequency.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep rule sets maintainable:<\/li>\n<li>Use reusable IP sets and regex pattern sets.<\/li>\n<li>Minimize overly complex regex and broad matches.<\/li>\n<li>Prefer managed rules for common threats; add targeted custom rules for app-specific risks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use a staged rollout:<\/li>\n<li>Dev\/test with Count \u2192 production with Block.<\/li>\n<li>Maintain a break-glass process:<\/li>\n<li>How to quickly relax a rule during an outage caused by false positives.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set CloudWatch alarms on:<\/li>\n<li>Sudden spikes in blocked requests<\/li>\n<li>Spikes in allowed requests with suspicious patterns (if you have metrics for that)<\/li>\n<li>Use dashboards to track:<\/li>\n<li>Top rules by matches<\/li>\n<li>Block rate over time<\/li>\n<li>Establish an incident playbook:<\/li>\n<li>Review logs, identify rule, apply temporary exception, follow up with root cause.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Tag WAF resources with:<\/li>\n<li><code>Owner<\/code>, <code>Environment<\/code>, <code>Application<\/code>, <code>CostCenter<\/code>, <code>DataClassification<\/code><\/li>\n<li>Use consistent naming:<\/li>\n<li><code>app-env-entrypoint-waf-acl<\/code> (e.g., <code>payments-prod-cloudfront-waf-acl<\/code>)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>All configuration is IAM-controlled.<\/li>\n<li>Use:<\/li>\n<li>MFA for privileged roles<\/li>\n<li>Approval workflows for policy changes (especially in production)<\/li>\n<li>Read-only roles for auditors and investigators<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF configuration is managed by AWS and stored by AWS.<\/li>\n<li>For logs:<\/li>\n<li>S3 supports SSE-S3 or SSE-KMS.<\/li>\n<li>If using SSE-KMS, ensure Firehose has KMS permissions and key policy allows usage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF protects only <strong>HTTP\/S<\/strong> traffic at integrated entry points.<\/li>\n<li>It does not replace:<\/li>\n<li>Security groups\/NACLs<\/li>\n<li>Network firewalls<\/li>\n<li>Private networking patterns for internal services<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid writing secrets into WAF custom responses or logs.<\/li>\n<li>Treat WAF logs as potentially sensitive (they can include URIs, headers, and other request metadata; redact downstream if required).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>AWS CloudTrail<\/strong> to audit WAF configuration changes.<\/li>\n<li>Store CloudTrail logs centrally (separate security account) in production.<\/li>\n<li>Use WAF logs for request-level investigations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS WAF helps implement controls for application security and monitoring, but:<\/li>\n<li>Compliance requires end-to-end controls (secure SDLC, access controls, logging, incident response).<\/li>\n<li>For compliance documentation, use <strong>AWS Artifact<\/strong> and service-specific compliance docs (verify in official sources).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Turning on strict managed rules in Block mode without testing (false positives causing outages).<\/li>\n<li>Not protecting the origin (e.g., leaving ALB public and bypassable when CloudFront is intended).<\/li>\n<li>Overreliance on IP allowlists\/denylists without additional controls.<\/li>\n<li>Storing WAF logs without proper access controls (PII\/credential leakage risk if apps place sensitive data into URLs\/headers).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with managed rules in <strong>Count<\/strong>, tune, then enforce gradually.<\/li>\n<li>Protect origins against bypass.<\/li>\n<li>Centralize logs with strict access controls and retention policies.<\/li>\n<li>Implement change management and automated deployment (IaC) where possible.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>AWS WAF is effective, but there are important boundaries.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (conceptual)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Only protects supported HTTP\/S entry points<\/strong> (CloudFront, ALB, API Gateway REST APIs, and other supported services per current docs).<\/li>\n<li>Not a network firewall (no raw TCP\/UDP inspection).<\/li>\n<li>Rule evaluation and inspection have <strong>size and complexity limits<\/strong> (e.g., request body inspection limits; oversize handling). <strong>Verify exact limits in official docs<\/strong> because they can differ by integration and change over time.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Quotas exist for:<\/li>\n<li>Web ACLs per account\/region<\/li>\n<li>Rules per web ACL<\/li>\n<li>Rule groups and IP set sizes<\/li>\n<li>Always check <strong>Service Quotas<\/strong> for current numbers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CloudFront-scope web ACL management has special regional behavior (commonly associated with us-east-1 control plane). Verify before automating.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>High request volume can make WAF request processing a major cost line.<\/li>\n<li>Logging everything at scale can be expensive (Firehose + S3 + analytics).<\/li>\n<li>Paid managed rule groups (e.g., bot-related) can add significant recurring costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some advanced behaviors depend on the protected service (CloudFront vs ALB vs API Gateway).<\/li>\n<li>Custom response support and certain actions may vary\u2014verify for your integration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WAF changes can take time to propagate, especially for CloudFront.<\/li>\n<li>Rule order matters; misordered allow rules can bypass intended blocks.<\/li>\n<li>Rate-based rules can block legitimate NATed user populations if thresholds are too low.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Migrating from <strong>AWS WAF Classic<\/strong> to the current AWS WAF requires careful mapping of rules and scopes. Follow AWS migration guidance and test thoroughly. Verify in official docs for the recommended migration path.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>AWS WAF fits a specific role: managed L7 protections at AWS-supported entry points. Here\u2019s how it compares to common alternatives.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>AWS WAF<\/strong><\/td>\n<td>L7 filtering for CloudFront\/ALB\/API Gateway<\/td>\n<td>Native AWS integration, managed rules, CloudWatch metrics, Firehose logging, scalable<\/td>\n<td>Costs scale with requests; limited to supported entry points; not L3\/4<\/td>\n<td>You run apps on AWS and need managed web protections<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Shield (Standard\/Advanced)<\/strong><\/td>\n<td>DDoS protection<\/td>\n<td>Designed for DDoS, integrates with CloudFront\/Route 53\/ALB<\/td>\n<td>Not a full WAF; doesn\u2019t replace app-layer filtering<\/td>\n<td>Use alongside WAF for DDoS + L7 protections<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Firewall Manager<\/strong><\/td>\n<td>Multi-account governance<\/td>\n<td>Central policy management across org<\/td>\n<td>Requires AWS Organizations; adds governance complexity<\/td>\n<td>You need consistent WAF policies across many accounts<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Network Firewall<\/strong><\/td>\n<td>L3\/4 + some L7 network controls in VPC<\/td>\n<td>VPC-level controls, network segmentation<\/td>\n<td>Not a web app firewall; different threat model<\/td>\n<td>You need VPC network firewalling, not just HTTP filtering<\/td>\n<\/tr>\n<tr>\n<td><strong>Cloudflare WAF<\/strong><\/td>\n<td>Edge WAF\/CDN<\/td>\n<td>Strong edge network, bot features, broad integrations<\/td>\n<td>Non-AWS native; different ops model; potential vendor lock-in<\/td>\n<td>You want CDN+WAF outside AWS or multi-cloud edge<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Armor<\/strong><\/td>\n<td>GCP L7 protections<\/td>\n<td>Integrates with Google\u2019s load balancing\/CDN<\/td>\n<td>Not AWS-native<\/td>\n<td>Your workloads are primarily on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Web Application Firewall<\/strong><\/td>\n<td>Azure L7 protections<\/td>\n<td>Integrates with Application Gateway\/Front Door<\/td>\n<td>Not AWS-native<\/td>\n<td>Your workloads are primarily on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed ModSecurity (Nginx\/Apache)<\/strong><\/td>\n<td>Full control, custom environments<\/td>\n<td>Maximum control, can run anywhere<\/td>\n<td>Ops overhead, patching, scaling, tuning effort<\/td>\n<td>You need custom inline control and accept operational burden<\/td>\n<\/tr>\n<tr>\n<td><strong>F5 \/ enterprise WAF appliances<\/strong><\/td>\n<td>Enterprise feature depth<\/td>\n<td>Mature feature set, enterprise support<\/td>\n<td>Cost, complexity, appliance lifecycle<\/td>\n<td>You require specialized enterprise WAF features and have budget\/ops maturity<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example (multi-account organization)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A large enterprise runs dozens of web apps across multiple AWS accounts and regions. Security wants baseline protections and consistent policy enforcement, while app teams need flexibility and minimal false positives.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>CloudFront in front of public web apps; ALB for regional ingress.<\/li>\n<li>AWS WAF web ACLs with:<ul>\n<li>AWS Managed Rules baseline<\/li>\n<li>Rate limits on login and search endpoints<\/li>\n<li>IP allowlists for admin endpoints<\/li>\n<\/ul>\n<\/li>\n<li>Central policy deployment via <strong>AWS Firewall Manager<\/strong> across AWS Organizations.<\/li>\n<li>Centralized logging: AWS WAF logs \u2192 Firehose \u2192 S3 in a dedicated security account; analysis via Athena\/SIEM.<\/li>\n<li>CloudWatch alarms for spikes in blocked requests.<\/li>\n<li><strong>Why AWS WAF was chosen:<\/strong><\/li>\n<li>Native integration with CloudFront\/ALB at scale.<\/li>\n<li>Managed rules reduce time-to-baseline.<\/li>\n<li>Firewall Manager supports governance across accounts.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced exposure to common web attacks.<\/li>\n<li>Faster incident response due to consistent metrics\/logging.<\/li>\n<li>Reduced configuration drift across accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example (single product, lean ops)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup exposes a public website and API and starts seeing scraping and credential-stuffing attempts. The team has limited time to manage security infrastructure.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>CloudFront + AWS WAF in front of the site.<\/li>\n<li>ALB behind CloudFront for application servers.<\/li>\n<li>WAF rules:<ul>\n<li>Managed baseline rules (Count \u2192 Block after review)<\/li>\n<li>Rate-based rules on <code>\/login<\/code> and <code>\/api\/search<\/code><\/li>\n<li>Simple allowlist for admin paths<\/li>\n<\/ul>\n<\/li>\n<li>Optional lightweight logging to S3 for 7\u201330 days during tuning.<\/li>\n<li><strong>Why AWS WAF was chosen:<\/strong><\/li>\n<li>Low operational overhead and quick setup.<\/li>\n<li>Integrates cleanly with CloudFront without deploying appliances.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced abusive traffic and origin load.<\/li>\n<li>Better visibility into attacks without building a full security platform.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is AWS WAF the same as AWS WAF Classic?<\/strong><br\/>\nNo. AWS WAF Classic is the legacy version. AWS WAF (current) uses the newer model (often called <code>wafv2<\/code> in APIs). Prefer AWS WAF for new deployments.<\/p>\n\n\n\n<p>2) <strong>What AWS services can I attach AWS WAF to?<\/strong><br\/>\nCommonly CloudFront, Application Load Balancers, and API Gateway REST APIs. AWS adds integrations over time\u2014verify the current supported resources in official docs.<\/p>\n\n\n\n<p>3) <strong>Does AWS WAF stop DDoS attacks?<\/strong><br\/>\nIt helps with some application-layer request floods and abusive patterns, but dedicated DDoS protection is handled by AWS Shield. In practice, teams often use <strong>Shield + WAF<\/strong> together.<\/p>\n\n\n\n<p>4) <strong>Can AWS WAF block SQL injection and XSS?<\/strong><br\/>\nIt can detect many common patterns using managed rules and rule statements, but it\u2019s not a substitute for secure coding. Use WAF as a compensating and layered control.<\/p>\n\n\n\n<p>5) <strong>What is a web ACL?<\/strong><br\/>\nA web ACL is the policy container in AWS WAF that holds ordered rules and defines a default action for requests.<\/p>\n\n\n\n<p>6) <strong>What\u2019s the difference between \u201cAllow,\u201d \u201cBlock,\u201d and \u201cCount\u201d?<\/strong><br\/>\n&#8211; <strong>Allow:<\/strong> permit the request.<br\/>\n&#8211; <strong>Block:<\/strong> deny the request (optionally with a custom response).<br\/>\n&#8211; <strong>Count:<\/strong> record that the request matched (metrics\/logs) but do not block\u2014useful for testing.<\/p>\n\n\n\n<p>7) <strong>How do I reduce false positives with managed rules?<\/strong><br\/>\nStart in <strong>Count<\/strong> mode, review sampled requests\/logs, then tune by excluding specific rules or adding scope-down statements (capabilities vary by managed group). Finally switch to Block.<\/p>\n\n\n\n<p>8) <strong>Can AWS WAF protect internal-only applications?<\/strong><br\/>\nOnly if requests flow through a supported integration point. Many internal apps use internal ALBs; WAF can be associated with ALBs depending on configuration, but ensure the traffic path is correct.<\/p>\n\n\n\n<p>9) <strong>Can attackers bypass AWS WAF by hitting my origin directly?<\/strong><br\/>\nYes, if your origin is directly reachable (public ALB, public API endpoint). Use origin protection patterns (restrict ALB access, use private origins, or enforce headers\/certs\u2014implementation depends on your architecture).<\/p>\n\n\n\n<p>10) <strong>Does AWS WAF inspect HTTPS traffic?<\/strong><br\/>\nIt inspects HTTP request data after TLS termination at CloudFront\/ALB\/API Gateway in the integrated flow. It does not decrypt traffic independently like a man-in-the-middle proxy.<\/p>\n\n\n\n<p>11) <strong>Where do AWS WAF logs go?<\/strong><br\/>\nAWS WAF delivers logs to <strong>Kinesis Data Firehose<\/strong>. From Firehose you typically deliver to S3 (common), and optionally to other supported destinations. Verify current Firehose destination options in your region.<\/p>\n\n\n\n<p>12) <strong>Can I use Infrastructure as Code (IaC) for AWS WAF?<\/strong><br\/>\nYes\u2014AWS WAF can be managed using tools like AWS CloudFormation\/Terraform\/CDK. Verify the exact resource types and properties in your IaC tool\u2019s current documentation.<\/p>\n\n\n\n<p>13) <strong>How quickly do rule changes take effect?<\/strong><br\/>\nIt depends on integration and propagation (CloudFront changes can take longer). Plan for minutes of propagation; verify expectations in official docs for your use case.<\/p>\n\n\n\n<p>14) <strong>Is AWS WAF good for bot protection?<\/strong><br\/>\nIt can help via rate limits, CAPTCHA\/Challenge, and Bot Control managed rules. Effectiveness depends on tuning and your threat model.<\/p>\n\n\n\n<p>15) <strong>What\u2019s the best way to operate AWS WAF day-to-day?<\/strong><br\/>\nMonitor metrics, alert on anomalies, review logs during incidents, and maintain a change process for rule updates. Use Count mode for testing changes.<\/p>\n\n\n\n<p>16) <strong>Should I enable logging for all web ACLs?<\/strong><br\/>\nNot always. Logging is valuable but can be expensive at high volume. Many teams enable full logging during tuning or incidents, and otherwise rely on metrics plus sampled requests.<\/p>\n\n\n\n<p>17) <strong>Can AWS WAF block by country?<\/strong><br\/>\nYes, via geo match rules. Use carefully\u2014geo blocking can affect legitimate travelers and VPN traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn AWS WAF<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>AWS WAF Developer Guide<\/td>\n<td>Primary, authoritative reference for concepts, rules, logging, and integrations: https:\/\/docs.aws.amazon.com\/waf\/latest\/developerguide\/what-is-aws-waf.html<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>AWS WAF Pricing<\/td>\n<td>Current pricing dimensions and examples: https:\/\/aws.amazon.com\/waf\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Pricing tool<\/td>\n<td>AWS Pricing Calculator<\/td>\n<td>Build estimates for WAF + CloudFront + logging stack: https:\/\/calculator.aws\/#\/<\/td>\n<\/tr>\n<tr>\n<td>CloudFront + WAF docs<\/td>\n<td>CloudFront + AWS WAF docs (official)<\/td>\n<td>How to associate web ACLs and understand scope\/propagation. Start from CloudFront\/WAF sections in AWS docs (verify the latest links via docs navigation).<\/td>\n<\/tr>\n<tr>\n<td>Logging docs<\/td>\n<td>AWS WAF logging (Firehose) docs<\/td>\n<td>Exact logging configuration, fields, and delivery considerations (verify current page from AWS WAF guide).<\/td>\n<\/tr>\n<tr>\n<td>Governance<\/td>\n<td>AWS Firewall Manager docs<\/td>\n<td>Central policy management across AWS Organizations: https:\/\/docs.aws.amazon.com\/waf\/latest\/developerguide\/fms-chapter.html (verify current URL in docs if it changes)<\/td>\n<\/tr>\n<tr>\n<td>Observability<\/td>\n<td>Amazon CloudWatch metrics for AWS WAF<\/td>\n<td>Understanding metric names\/dimensions and alarms (navigate from WAF docs to monitoring section).<\/td>\n<\/tr>\n<tr>\n<td>Reference architecture<\/td>\n<td>AWS Architecture Center<\/td>\n<td>Browse patterns combining CloudFront, WAF, Shield, and centralized logging: https:\/\/aws.amazon.com\/architecture\/<\/td>\n<\/tr>\n<tr>\n<td>Official solution<\/td>\n<td>AWS WAF Security Automations (Solution)<\/td>\n<td>AWS Solution that helps automate WAF protections (verify current solution name and repo from AWS Solutions Library). Start here: https:\/\/aws.amazon.com\/solutions\/<\/td>\n<\/tr>\n<tr>\n<td>Videos<\/td>\n<td>AWS YouTube (official)<\/td>\n<td>Recorded sessions and demos for WAF, Shield, and edge security: https:\/\/www.youtube.com\/@amazonwebservices<\/td>\n<\/tr>\n<tr>\n<td>CLI reference<\/td>\n<td>AWS CLI <code>wafv2<\/code> command reference<\/td>\n<td>Useful for scripting and automation; verify exact commands\/parameters: https:\/\/docs.aws.amazon.com\/cli\/latest\/reference\/wafv2\/<\/td>\n<\/tr>\n<tr>\n<td>Community (reputable)<\/td>\n<td>AWS re:Post discussions on AWS WAF<\/td>\n<td>Practical troubleshooting and edge cases; validate against official docs: https:\/\/repost.aws\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following training providers are listed as requested. Evaluate current course outlines, instructors, and reviews on each site.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, cloud engineers<\/td>\n<td>AWS security fundamentals, WAF\/edge security patterns, DevSecOps practices<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate DevOps learners<\/td>\n<td>CI\/CD + cloud basics; may include security modules<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud operations, monitoring, security operations basics<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, platform teams<\/td>\n<td>Reliability engineering, production operations, security\/observability integration<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops and platform teams exploring AIOps<\/td>\n<td>Operational analytics, incident response concepts, automation<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>These sites are provided as training resources\/platforms. Review current content and offerings directly on each site.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training content (verify current scope)<\/td>\n<td>Students, engineers seeking guided learning<\/td>\n<td>https:\/\/www.rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and coaching (verify current scope)<\/td>\n<td>DevOps engineers, freshers, teams<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps services\/training (verify offerings)<\/td>\n<td>Teams needing short-term expert help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support\/training resources (verify offerings)<\/td>\n<td>Ops teams needing practical support<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These companies are listed as requested. Confirm service details, engagement models, and references directly with each provider.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify exact catalog)<\/td>\n<td>Architecture reviews, cloud operations, security hardening<\/td>\n<td>WAF policy rollout, CloudFront\/ALB ingress design, logging pipeline setup<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps\/cloud consulting &amp; training<\/td>\n<td>Platform engineering, DevSecOps practices<\/td>\n<td>WAF + Shield architecture, IaC implementation, SOC observability enablement<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify exact services)<\/td>\n<td>CI\/CD, cloud migration, security practices<\/td>\n<td>Secure ingress standardization, WAF rule tuning, cost optimization for logging<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before AWS WAF<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>HTTP fundamentals<\/strong>: headers, methods, status codes, cookies, query strings<\/li>\n<li><strong>TLS basics<\/strong>: termination, certificates, where decryption happens<\/li>\n<li><strong>AWS networking basics<\/strong>: VPC, ALB, security groups, CloudFront origins<\/li>\n<li><strong>Identity and access<\/strong>: IAM users\/roles\/policies, least privilege<\/li>\n<li><strong>Logging\/monitoring<\/strong>: CloudWatch metrics\/alarms, S3 log storage<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after AWS WAF<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Shield Advanced<\/strong> for DDoS incident response (if your risk profile requires it)<\/li>\n<li><strong>AWS Firewall Manager<\/strong> for multi-account governance<\/li>\n<li><strong>Threat modeling and AppSec<\/strong>: OWASP Top 10, secure SDLC<\/li>\n<li><strong>SIEM\/SOAR integrations<\/strong> for alerting and response<\/li>\n<li><strong>IaC and policy-as-code<\/strong> for repeatable deployments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use AWS WAF<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud security engineer<\/li>\n<li>Application security engineer (AppSec)<\/li>\n<li>DevOps engineer \/ platform engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Security operations analyst (with WAF log analytics)<\/li>\n<li>Solutions architect (designing edge\/ingress patterns)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (AWS)<\/h3>\n\n\n\n<p>AWS certifications change over time, but relevant tracks commonly include:\n&#8211; AWS Certified Solutions Architect (Associate\/Professional)\n&#8211; AWS Certified Security \u2013 Specialty (if available; verify current AWS certification catalog)\n&#8211; AWS Certified Advanced Networking (for broader networking context)<\/p>\n\n\n\n<p>Always verify current certification names and availability: https:\/\/aws.amazon.com\/certification\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a multi-environment WAF baseline (dev\/stage\/prod) with:<\/li>\n<li>Managed rules in Count for dev<\/li>\n<li>Managed rules in Block for prod<\/li>\n<li>Automated deployment via IaC<\/li>\n<li>Create a log analytics pipeline:<\/li>\n<li>WAF logs \u2192 S3 \u2192 Athena \u2192 dashboards and alerts<\/li>\n<li>Implement origin protection:<\/li>\n<li>CloudFront + WAF in front of ALB, restrict ALB to CloudFront (pattern depends on your design\u2014verify best practice options)<\/li>\n<li>Design an incident playbook:<\/li>\n<li>How to respond to a scraping attack using rate limits and temporary IP blocks<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS WAF<\/strong>: AWS managed web application firewall for HTTP(S) traffic filtering.<\/li>\n<li><strong>WAF Classic<\/strong>: Legacy AWS WAF version; generally not recommended for new deployments.<\/li>\n<li><strong>Web ACL<\/strong>: A set of ordered rules plus a default action attached to a protected resource.<\/li>\n<li><strong>Rule<\/strong>: A condition (statement) and an action (allow\/block\/count\/captcha\/challenge).<\/li>\n<li><strong>Rule group<\/strong>: A reusable collection of rules (custom or managed).<\/li>\n<li><strong>Managed rule group<\/strong>: A curated rule group maintained by AWS or a third party.<\/li>\n<li><strong>IP set<\/strong>: A named list of IP addresses\/CIDRs used in WAF rules.<\/li>\n<li><strong>Regex pattern set<\/strong>: A reusable set of regex patterns for matching request components.<\/li>\n<li><strong>Rate-based rule<\/strong>: A rule that matches when request rate exceeds a defined threshold over a time window.<\/li>\n<li><strong>Count<\/strong>: Action that records matches without blocking, used for safe testing and tuning.<\/li>\n<li><strong>CloudFront scope \/ Regional scope<\/strong>: The scope of a WAF web ACL depending on the protected resource type.<\/li>\n<li><strong>Kinesis Data Firehose<\/strong>: Managed service used by AWS WAF to deliver logs to destinations like S3.<\/li>\n<li><strong>CloudWatch metrics<\/strong>: Time-series metrics emitted for rules\/web ACLs, used for monitoring and alarms.<\/li>\n<li><strong>Sampled requests<\/strong>: A limited set of matching requests shown for investigation in the console.<\/li>\n<li><strong>Origin<\/strong>: The backend destination CloudFront fetches content from (S3, ALB, custom origin).<\/li>\n<li><strong>OWASP Top 10<\/strong>: Common classes of web application security risks.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>AWS WAF is AWS\u2019s managed <strong>web application firewall<\/strong> in the <strong>Security, identity, and compliance<\/strong> category, designed to filter and control <strong>HTTP(S)<\/strong> requests at key AWS entry points like <strong>CloudFront<\/strong>, <strong>ALB<\/strong>, and <strong>API Gateway<\/strong>. It matters because it reduces application-layer risk from common exploits and abuse, while providing operational visibility through <strong>CloudWatch metrics<\/strong>, sampled requests, and optional full <strong>logging via Kinesis Data Firehose<\/strong>.<\/p>\n\n\n\n<p>From an architecture perspective, AWS WAF fits best as part of a layered edge\/ingress strategy\u2014often paired with CloudFront caching, origin protection, and (when needed) AWS Shield for DDoS. Cost is driven primarily by <strong>request volume<\/strong>, <strong>number of rules<\/strong>, and any <strong>paid managed rule groups<\/strong>, plus indirect costs for log delivery and storage.<\/p>\n\n\n\n<p>Use AWS WAF when you need managed L7 protections tightly integrated with AWS front doors and you want to balance fast baseline security (managed rules) with app-specific controls (custom rules and rate limits). Next steps: implement IaC for repeatability, enable logging with a cost-aware retention strategy, and develop a tuning\/incident-response playbook based on real traffic.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security, identity, and compliance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,39],"tags":[],"class_list":["post-326","post","type-post","status-publish","format-standard","hentry","category-aws","category-security-identity-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=326"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/326\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}