AWS WAF

Security, Identity & Compliance

Layer 7 firewall that inspects and filters HTTP(S) requests before they reach CloudFront, ALB, or API Gateway.

Verified against AWS documentation · 2026-09-09

Key facts

  1. 01A web ACL holds your rules, evaluated in priority order — first match wins, and a default action (allow or block) catches everything else
  2. 02Attaches to CloudFront, ALB, API Gateway REST, AppSync, Cognito user pools, App Runner, Amplify, Verified Access — never directly to an EC2 instance
  3. 03AWS Managed Rules cover the common attacks out of the box (SQLi, XSS, known-bad inputs, bad IP reputation) — writing rules from scratch is the exception
  4. 04Rate-based rules count requests per IP over a 1- or 5-minute window; Count mode lets you dry-run a rule in production before it blocks anyone
  5. 05Naming note: the new AWS WAF console calls a web ACL a "protection pack" — the exam still says web ACL

Exam triggers

Phrases and scenarios that point here.

  • "SQL injection", "cross-site scripting", "OWASP Top 10", "common web exploits" → WAF
  • "Block requests from specific countries or IP ranges" → WAF geo-match rule or IP set
  • "Layer 7", "HTTP flood", "filter requests before they reach the application" → WAF, not Shield and not security groups
  • "Throttle requests to the login page" / "limit requests per IP" → rate-based rule

Not this service

  • Network/transport layer (L3/L4) DDoS protection → Shield (Standard is automatic and free; Advanced adds the response team and cost protection)
  • Filtering by IP and port at the instance or subnet level → security groups and network ACLs
  • Inspecting all VPC traffic, not just HTTP → Network Firewall
  • Pushing one firewall policy across every account and every new resource → Firewall Manager

Use cases

  1. 01Shielding a legacy app you can't safely patch — WAF blocks SQLi and XSS at the edge while the real fix works its way through the release cycle
  2. 02Geo-blocking for a regional business: a store that only ships to two countries drops everything else at CloudFront, shrinking both attack surface and origin load
  3. 03Rate-limiting login and password-reset endpoints so credential-stuffing bots get throttled per IP without a single line of application code changing
  4. 04Stopping competitor scraping on a listings site (jobs, property, tickets) — Bot Control plus a CAPTCHA action on the search endpoint
  5. 05Incident response: add an IP set to the existing web ACL and block a hostile range in minutes, no deployment required

How it's charged

  1. 01Three base dimensions: per web ACL per month, per rule and per rule group per month, and per million requests inspected — monthly fees prorated hourly
  2. 02AWS Managed Rules cost nothing beyond the flat per-rule-group fee; AWS Marketplace rule groups add the seller's own subscription and per-request charges on top
  3. 03Allow, Block, and Count actions are free — CAPTCHA attempts and Challenge responses are billed per event
  4. 04Bot Control and Fraud Control (account takeover, fake signups) add a monthly per-web-ACL subscription plus per-request fees; Fraud Control's per-login rates run far above the base request rate and are the usual source of a surprise WAF bill
  5. 05Quiet surcharges: web ACLs above the default capacity allocation and request bodies above the default inspection size both add per-million-request fees, and WAF logs are billed by their destination beyond the included allowance

Commonly confused with

AWS ShieldSecurity, Identity & ComplianceAWS Firewall ManagerSecurity, Identity & Compliance

References