Careeroza

AWS WAF

AWS WAF (Web Application Firewall) is a layer 7 security service designed to protect web applications and APIs from common web exploits and bots that could compromise availability, endanger security, or consume excessive computing resources.


Unlike traditional network firewalls that block traffic based purely on IP addresses or port numbers (Layers 3 and 4), AWS WAF inspects the deep data payload inside HTTP and HTTPS requests (Layer 7).


1. Supported Integration Points

AWS WAF does not sit directly on an open ec2 instance or inside a standard subnet routing table. Instead, it must be attached directly to specific entry-point infrastructure assets:

  • Amazon CloudFront: Deploys WAF at global edge locations to filter malicious requests before they ever cross into the AWS internal cloud network.

  • Application Load Balancer (ALB): Inspects traffic hitting regional server clusters or container fleets.

  • Amazon API Gateway: Protects REST or HTTP backend microservices.

  • AWS AppSync: Secures GraphQL query backends.

  • Amazon Cognito User Pools: Guards identity login endpoints directly from credential stuffing or brute-force automation.


2. Core Architectural Components

The structure of AWS WAF revolves around a hierarchy of logical resources:

Web Access Control Lists (Web ACLs)

A Web ACL is the primary parent wrapper or configuration block that you attach to your resource. It contains a collection of one or more rules arranged in a strict processing sequence, along with a Default Action setting (typically set to Allow all traffic that does not explicitly match a block criteria).


Rules

A rule defines the precise matching conditions for an incoming HTTP request. Each rule evaluates components such as:

  • The Request Structure: IP addresses of origin, country coordinates (Geo-matching), URI path strings, HTTP headers, query strings, or specific patterns inside the JSON body text.

  • Transformations: Commands that strip out formatting distortions (like converting text to lowercase or decoding URL encodings) before evaluation, preventing attackers from using obfuscation tactics to slip past filters.

Rule Actions

When a request matches a rule's conditions, AWS WAF triggers one of five definitive actions:

  1. Allow: The request is verified as clean and passes through directly to the target backend application.

  2. Block: The request is terminated immediately, and AWS WAF returns a customizable HTTP 403 Forbidden error status to the sender.

  3. Count: The request is simply counted in CloudWatch metrics, and evaluation passes down to the next rule in the list. This is highly useful for testing new patterns in production without breaking live traffic.

  4. CAPTCHA: The user is prompted with an interactive visual puzzle to solve before their request is allowed to reach the backend.

  5. Challenge: Runs a silent, non-interactive JavaScript check inside the background of the user's browser to verify the request originates from a legitimate web client rather than an automated script.


3. Types of Rule Sets

Managed Rule Groups

Pre-configured collections of rules written, maintained, and automatically updated by AWS or third-party security vendors (available via AWS Marketplace).

  • Core Rule Set (CRS): Targets common web vulnerabilities, including those outlined in the OWASP Top 10 lists (such as cross-site scripting (XSS) or exploitation of invalid bad inputs).

  • Amazon IP Reputation List: Uses global threat intelligence pools to proactively block known botnets, scrapers, and malicious scanning hosts.

  • Bot Control / Fraud Prevention: Advanced paid modules designed to detect automated credential-stuffing attempts and fake account creation workflows.

Custom Rules

Bespoke rules you design yourself to protect unique aspects of your software backend.

  • Rate-Based Rules: Tracks the incoming volume of requests coming from individual IP addresses over a sliding 5-minute window. If an single client exceeds a configured cap (e.g., more than 100 hits to a /api/login endpoint), WAF automatically blocks that IP until its request velocity slows down.

4. Web ACL Capacity Units (WCUs)

To ensure that calculating hundreds of regex matches doesn't add major performance latency to web responses, AWS limits the size and complexity of a Web ACL using a metric called Web ACL Capacity Units (WCUs).

  • Every rule you add is assigned a WCU cost based on its structural complexity. For example, a simple IP match costs 1 WCU, a standard URI regex string match costs 3 WCUs, while complex body inspections or bot control suites cost significantly more.

  • A standard Web ACL has a strict maximum capacity ceiling (typically 1,500 WCUs). Developers must budget their custom rules and managed groups to fit under this ceiling to ensure maximum traffic processing speeds.