AWS WAF
Layer-7 protection against SQLi, XSS, bots, and application-layer DDoS.
AWS WAF (Web Application Firewall) is a managed service that protects web applications from common web exploits and malicious traffic. It monitors and filters incoming HTTP/HTTPS requests to AWS resources such as Application Load Balancers, Amazon API Gateway, and Amazon CloudFront.
Objective
- Protect web applications from common web-based attacks.
- Prevent unauthorized or malicious traffic from reaching backend systems.
- Enforce security rules at the application layer (Layer 7).
- Detect and mitigate automated bot traffic.
- Apply rate limiting to prevent abuse and denial-of-service patterns.
Architecture
Components
Web ACL
A Web ACL (Access Control List) is a collection of rules that define how web traffic is evaluated. Each request is inspected against the rules in order, and an action is taken:
- Allow — forward the request to the application.
- Block — reject malicious requests.
- Count — monitoring only (no enforcement).
Rule types
| Rule type | Description |
|---|---|
| Managed | Predefined AWS/partner rule sets — Common Rule Set, known bad inputs, SQLi, XSS. |
| Custom | User-defined rules based on IP, headers, query strings, body, or geo-location. |
| Rate-based | Limit requests from a single IP over a time window to prevent abuse. |
Request processing flow
- A client sends an HTTP/HTTPS request.
- The request is intercepted by AWS WAF.
- WAF evaluates the request against the configured Web ACL rules.
- Allowed requests are forwarded; malicious requests are blocked; suspicious requests may be logged or counted.
- Logs and metrics are generated for monitoring and analysis.
Threats mitigated
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Remote file inclusion and command injection
- Malicious bots and crawlers
- Brute-force attacks
- HTTP flood attacks
- IP reputation-based threats
- Application-layer DDoS patterns
Integration
AWS WAF integrates with the Application Load Balancer, Amazon API Gateway, Amazon CloudFront, AWS Shield (for DDoS protection), Amazon CloudWatch (metrics and alarms), WAF logs (via Kinesis Data Firehose), and AWS Security Hub for centralized posture.