ACKF logoACKF
Security, Identity, and Compliance

AWS WAF

View on GitHub

AWS WAF

AWS WAF is a web application firewall that protects HTTP and HTTPS endpoints by evaluating and filtering Layer 7 requests using web ACLs and rule statements. It operates as a managed, rule-based filtering service that you attach to Amazon CloudFront distributions or regional endpoints such as Application Load Balancers and Amazon API Gateway. In architectures it normally sits in front of web applications or APIs to block or allow requests before they reach backend compute or storage resources.

🗂 Resource Category

Security, Identity, and Compliance • Networking and Content Delivery

🧠 Exam Memory Hook

Think: "Layer 7 protection + rule sets + edge or regional placement = AWS WAF"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the underlying service control plane, storage, networking, and availability of the AWS WAF platform, and applies patches to the managed service infrastructure and runtime. AWS is responsible for the security and patching of the physical infrastructure and managed service components that host AWS WAF. AWS also provides managed rule groups that can be consumed by customers but does not modify customer configurations.

Customer responsibilities: The customer configures web ACLs, rule groups (managed or custom), IP sets, rate-based rules, and the associations to CloudFront, Application Load Balancers, or API Gateway; configures logging and metrics; tests and tunes rules to avoid false positives; and implements monitoring and alerting. The customer is responsible for application security beyond request filtering, securing backend resources, handling remediation of blocked traffic as needed, and managing any customer-side automation that responds to WAF events.

Patching responsibilities: AWS patches the physical infrastructure and the managed service runtime that implements AWS WAF; customers do not patch the WAF service platform. If customers run their own compute (for example Amazon EC2 instances or self-managed containers), the customer is responsible for patching guest operating systems, installed runtimes, libraries, dependencies, and applications on those hosts. For serverless or fully managed targets, AWS patches the provided platform components while customers remain responsible for their code and packaged dependencies.

🏗 Typical Architecture

💡 Top 5 Features

  • Web ACLs that evaluate incoming HTTP(S) requests with ordered rule statements
  • Support for managed rule groups from AWS and marketplace vendors
  • Custom rule statements including IP sets, rate-based rules, string/byte matching, and geographic match
  • Associations with CloudFront for global edge evaluation and with regional endpoints such as ALB and API Gateway
  • Request sampling, real-time metrics, and logging to CloudWatch Logs or Kinesis Data Firehose

✅ Top 5 Use Cases

  • Protect a public web application from common web exploits such as SQL injection and cross-site scripting using managed and custom rules
  • Mitigate API abuse by applying rate-based rules and IP blocking to API Gateway endpoints
  • Block or allow traffic based on geographic location and IP reputation lists before it reaches backend services
  • Enforce application-layer security controls for content delivered through Amazon CloudFront at edge locations
  • Enable centralized rule management (when used with AWS Firewall Manager) to maintain consistent web ACLs across multiple accounts and resources

🏗 Architecture Placement

AWS WAF is deployed as an inline, Layer 7 protection layer attached to edge distributions (Amazon CloudFront) or regional endpoints (Application Load Balancer, Amazon API Gateway). Incoming HTTP(S) requests from clients are evaluated by WAF before they reach the protected origin or load balancer; allowed requests are forwarded to the backend compute or service. Deployment can be global (via CloudFront) or regional (ALB/API Gateway) depending on the association chosen. Logging and metrics are typically exported to CloudWatch or Kinesis Data Firehose for analysis and alerting.

🎯 Commonly Used With

- Amazon CloudFront
- Application Load Balancer
- Amazon API Gateway
- Amazon CloudWatch
- AWS Lambda

🌍 5 Real-World Examples

  • A retail website uses AWS WAF with CloudFront and managed rule groups to block common injection attacks and protect the storefront during peak traffic.
  • A financial services firm attaches AWS WAF to API Gateway to enforce rate limits and IP allow lists for customer-facing APIs to reduce abuse.
  • A healthcare application applies AWS WAF rules at an ALB to block suspicious request patterns before they reach patient data services, reducing exposure at the application layer.
  • A media company uses AWS WAF with CloudFront to filter bot traffic and protect media ingestion endpoints, improving backend stability.
  • A government public portal deploys AWS WAF with custom rules to restrict access by geographic region and to log suspicious requests for investigation.

🎓 AWS Exam Clues

  • Used for Layer 7 HTTP/HTTPS filtering and request inspection rather than network-level filtering.
  • Associate with Amazon CloudFront for edge-based protection and with ALB/API Gateway for regional protection.
  • Choose managed rule groups for broad coverage and custom rules for application-specific patterns and business logic.
  • Use rate-based rules in WAF to mitigate application-layer request floods while noting network DDoS protection is a separate concern.
  • Logging to CloudWatch Logs or Kinesis Data Firehose is needed to analyze blocked requests and tune rules.

📝 Quick Revision

AWS WAF is a managed Layer 7 web application firewall that evaluates HTTP(S) requests using web ACLs and rule statements. Use it when you need request-level filtering at the edge or regionally; plan for rule testing, logging, and coordination with downstream services and DDoS protections. Consider regional versus CloudFront associations and ensure monitoring and change control to avoid service disruption.

🏷 Keywords

web ACL • managed rule group • custom rule • rate-based rule • IP set • byte match • SQL injection • cross-site scripting • CloudFront association • ALB association • logging to Kinesis Data Firehose • CloudWatch metrics