AWS WAF

What it is

AWS WAF is a web application firewall that monitors the HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry and HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry requests sent to your applications and allows, blocks, or counts them based on rules you define. When a request is blocked, the protected service returns HTTP 403 (Forbidden) or a custom response.

WAF protects these resource types:

Amazon CloudFront distributions.
Application Load Balancers.
Amazon API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry APIs.
AWS AppSync GraphQL APIs.
Amazon Cognito user pools.
AWS App Runner services.
AWS Verified Access.
AWS Amplify.

Choose WAF when a question asks to block SQL injectionAn attack that slips SQL code into form fields or parameters so that an application runs it against its database, for example to read or delete data. Parameterized queries prevent it, and AWS WAF can block common patterns.Glossary entry, XSS (Cross-site scripting)An attack that injects malicious script into a web page so that it runs in other users' browsers, where it can steal their session or data. AWS WAF has rules that match common XSS patterns in requests.Glossary entry (XSS), bad bots, specific IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses or countries, or to rate-limit requests to a web application. To protect against DDoS (Distributed denial of service)An attack that floods an application or network with traffic from many sources at once, to make it unavailable to real users. AWS Shield Standard protects every AWS customer from common network-layer DDoS attacks at no extra cost.Glossary entry attacks, also use AWS Shield.

Concepts

Protection pack (web ACL (Access control list)A list attached to a resource that names who may access it and what they may do. VPC subnets have network ACLs; Amazon S3 buckets also support ACLs, but new buckets disable them in favor of policies.Glossary entry): the set of rules attached to a protected resource. The newer console calls web ACLs protection packs. It has a default action (allow or block) for requests that match no rule.
Rules and rule groups: rules are evaluated in priority order. Reusable rule groups include AWS Managed Rules, maintained by AWS. Examples are the core rule set (CRS), known bad inputs, SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry database, operating system rules, and IP reputation lists such as the Amazon IP reputation list and the anonymous IP list.
Rule statements:
- SQL injection and cross-site scripting match statements.
- IP set match, to allow or block lists of addresses.
- Geographic match, to allow or block countries.
- String, regex, and size matches on any part of the request.
- Rate-based rules, to limit requests from one IP address or another aggregation key over a time window.
Rule actions: Allow, Block, Count (monitor without blocking, useful for testing), and CAPTCHA or Challenge to verify that the client is a human or a real browser.
Bot Control: a managed rule group that detects and manages bot traffic.

Security, resilience, performance, and cost

Security

Start new rules in Count mode, review the logs, then switch to Block.
Use managed rule groups for broad coverage, and IP sets and rate-based rules for targeted threats.

Resilience

Attach WAF to CloudFront to filter requests at the edge, before they reach your AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry. Combine it with Shield for DDoS resilience.

Monitoring

Send logs to CloudWatch Logs, S3, or Data Firehose; use CloudWatch metrics and sampled requests to see what rules match.

Cost

Pay per protection pack (web ACL) per month, per rule per month, and per million requests. Requests beyond the default 1,500 WAF capacity units (WCU (Write capacity unit)The unit of write throughput in DynamoDB: one write per second of an item up to 1 KB. A transactional write uses two.Glossary entry) per web ACL, and features such as Bot Control, cost extra.
A Shield Advanced subscription covers standard WAF fees for protected resources.

WAF or another option?

If the requirement is	Choose
Block SQL injection or XSS against a web app	AWS WAF
Block specific countries at CloudFront	WAF geographic match, or CloudFront geographic restrictions
Rate-limit requests per IP	WAF rate-based rule
Protect against large DDoS attacks, with expert help	AWS Shield Advanced
Apply the same WAF rules in every account	AWS Firewall Manager
Filter non-HTTP traffic in a VPC	AWS Network Firewall

Reverse mindmap: when the question points here

Is it AWS WAF?

Yes, when the question says
- Block SQL injection or cross-site scripting leads to WAF
- Web application firewall for CloudFront, ALB, or API Gateway leads to WAF
- Block requests from certain IPs leads to WAF IP set
- Block requests from certain countries leads to WAF geographic match
- Too many requests from one client leads to Rate-based rule
- Scrapers and bad bots leads to Bot Control
- Verify humans before login leads to CAPTCHA or Challenge action
Run it well
- Test a rule without blocking leads to Count action
- Common protections maintained by AWS leads to AWS Managed Rules
- Analyze blocked requests leads to WAF logs
No, when the question says
- Volumetric DDoS leads to Shield
- Network traffic inspection in a VPC leads to Network Firewall

Key takeaways

WAF filters HTTP(S) requests to CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access, and Amplify.
Protection packs (web ACLs) hold rules and rule groups, including AWS Managed Rules, with a default action.
Statements match SQL injection, XSS, IP sets, countries, strings, and request rates; actions are Allow, Block, Count, CAPTCHA, and Challenge.
Log to CloudWatch Logs, S3, or Firehose; pricing is per web ACL, rule, and request.