Flash card
AWS WAF: rules evaluating HTTP and HTTPS requests at CloudFront, ALB, API Gateway, AppSync and a few other fronts.
- Operates on HTTP request content: URI, headers, query string, body, method, and the source address.
- Web ACLs hold rules and rule groups evaluated in priority order, each ending in allow, block, count, or CAPTCHA.
- AWS managed rule groups cover common categories, including the OWASP-style core set, known bad inputs, and IP reputation lists.
- Rate-based rules count requests per source over a window and act when a client exceeds a threshold, which is per-client throttling rather than volumetric defence.
- Count mode lets a rule run and log without blocking, which is how a new rule is validated before it can break legitimate traffic.
Pick it when
Pick it when the attack is in the request itself: injection, malicious payloads, bad bots, or one client sending far too much. Pick it over Shield when the requirement names an application-layer exploit rather than flood volume.
It's the wrong answer when
It is the wrong answer for non-HTTP traffic, and for anything below layer 7. A UDP flood, a filtering requirement across a whole VPC, or outbound domain filtering are not WAF. It also does not defend the origin if the origin is reachable directly, so a scenario where attackers bypass CloudFront wants origin access locked down as well.