Web Application Firewall (WAF)

AWS WAF is a web application firewall that monitors and filters HTTP/HTTPS requests to your web applications hosted behind CloudFront, ALB, API Gateway, AppSync, Amazon Cognito user pools, AWS App Runner, AWS Verified Access, or AWS Amplify. It protects against common web exploits at Layer 7 (application layer).

What WAF Protects Against

• SQL injection
• Cross-site scripting (XSS)
• Bot traffic and scrapers
• Rate limiting (DDoS mitigation at L7)
• Geo-blocking (restrict by country)
• IP reputation lists

Capacity and Limits That Shape Rule Design

WAF measures rule complexity in web ACL capacity units (WCUs), and the ceilings are fixed: a web ACL can hold at most 5,000 WCUs, and using more than 1,500 WCUs incurs additional cost beyond the base web ACL price. Other defaults worth knowing: 100 web ACLs per account per region (adjustable), at most 10 rate-based rules per web ACL, and body inspection limits that differ by resource type. For Application Load Balancer and AppSync protections, WAF inspects at most the first 8 KB of a request body; for CloudFront, API Gateway, Cognito, App Runner, and Verified Access the default is 16 KB, configurable up to 64 KB. Anything past the inspection limit passes through uninspected unless you add a rule to block oversized bodies.

How It Goes Wrong in Practice

The most common operational failure is the permanent Count mode. Teams deploy AWS Managed Rules in Count mode to observe before blocking, which is exactly the right first step, then never flip them to Block. The dashboard shows matches, everyone feels protected, and no request is ever actually denied. If your web ACL has been in Count mode for six months, you have monitoring, not a firewall.

The second classic is the origin bypass. WAF is attached to CloudFront, but the origin ALB keeps a security group open to the whole internet. Attackers find the origin address (through DNS history, certificate transparency logs, or plain scanning) and send requests straight to the ALB, skipping CloudFront and every WAF rule with it. The fix is to make the origin unreachable except through the fronting layer: restrict the ALB with the CloudFront managed prefix list or origin authentication headers, or attach a second regional web ACL to the ALB itself.

Third, the body inspection gap above: an 8 KB limit on ALB means a SQL injection payload placed after 8 KB of padding is never inspected. WAF provides oversize handling settings on body-inspecting rules precisely so you can block or flag requests that exceed the limit; leaving oversize handling on Continue while inspecting bodies is a quiet hole.

Practical Check: Inventory Your Web ACLs

List web ACLs protecting regional resources (ALB, API Gateway, and others) in the current region:

aws wafv2 list-web-acls --scope REGIONAL

For CloudFront distributions, the scope is global and the call must go to us-east-1:

aws wafv2 list-web-acls --scope CLOUDFRONT --region us-east-1

An empty list in a region where you run internet-facing ALBs is the finding. From there, check each web ACL's rules for Count-mode leftovers and confirm every internet-facing resource is actually associated with a web ACL, since an unassociated web ACL protects nothing.

Frequently Asked Questions

Does AWS WAF stop DDoS attacks?

It helps at Layer 7: rate-based rules can throttle HTTP floods per source IP, with a minimum configurable rate of 10 requests and up to 10,000 unique IPs rate-limited per rule. Volumetric Layer 3/4 attacks are handled below WAF by AWS Shield. Treat WAF rate limiting as one layer of DDoS defense, not the whole answer.

What is the difference between Count and Block?

Count records that a rule matched and lets the request continue; Block denies it. Count exists for safe rollout: run new rules in Count, review matches for false positives against legitimate traffic, then switch to Block. The discipline is putting a date on the switch when you deploy, so observation mode does not become the permanent state.

How much request body does WAF actually inspect?

Up to 8 KB for ALB and AppSync protections. For CloudFront, API Gateway, Cognito, App Runner, and Verified Access, 16 KB by default, raisable to 64 KB in the web ACL configuration. Pair body inspection with oversize handling rules so requests exceeding the limit are blocked rather than waved through.