SysPad › Lessons › security lessons › AWS WAF

How AWS WAF works

Web Application Firewall protecting against SQL injection, XSS, bots, and rate abuse. Attaches to ALB, API Gateway, or CloudFront. Blocked requests never reach the backend; a WebACL is bounded by a 1,500 WCU capacity budget, not by throughput.

A load balancer happily forwards a SQL-injection attempt or a credential-stuffing flood, it just moves bytes. AWS WAF is the bouncer that actually reads the request and decides whether to let it in. It sits at the edge, matches traffic against rules, and blocks the bad stuff before it ever touches your application.

What you will learn

What does a web application firewall inspect, and where does it sit?
How do web ACLs and rules decide allow / block / count?
How do managed rules and rate-based rules save you work?
What WAF does NOT protect against (and what does)?

Reading requests at the edge

WAF is a Layer-7 firewall: it inspects HTTP/HTTPS requests, method, path, headers, query string, and body, attached in front of resources like CloudFront, ALB, API Gateway, and AppSync (the list also includes Cognito user pools, App Runner, and more). It evaluates each request before your app sees it.

Web ACLs and rules

You attach a web ACL (access control list) containing rules. Each rule matches on conditions, IP sets, geographic location, string/regex patterns, size, SQLi/XSS signatures, and takes an action: Allow, Block, or Count (log without blocking, great for testing a rule safely).

Managed rules and rate limiting

You don’t have to write everything. Managed rule groups (from AWS and vendors) cover common threats, OWASP Top 10, known bad inputs, bot patterns, updated for you. Rate-based rules block IPs that exceed a request threshold, taming floods, scraping, and brute-force attempts.

⚓ Public web apps and APIs needing protection from injection, bots, scrapers, and abusive traffic.

What WAF does and doesn’t cover

WAF defends the application layer: injection, bad bots, abusive request patterns. It is not a network-layer DDoS shield, large volumetric (Layer 3/4) attacks are handled by AWS Shield (with Shield Advanced for the worst cases), often alongside WAF on CloudFront.

Flashcards

What does AWS WAF inspect, and where does it attach?: HTTP(S) request contents (Layer 7), attached to CloudFront, ALB, API Gateway, or AppSync.
What three actions can a WAF rule take?: Allow, Block, or Count (log only, for safely testing a rule before enforcing).
How do you cover common threats (OWASP, bad inputs) without writing every rule?: Use managed rule groups from AWS/vendors, maintained and updated for common web threats.
How does WAF tame a flood from a single IP?: A rate-based rule blocks IPs exceeding a request threshold over a window, mitigating floods/brute-force/scraping.
WAF vs Shield?: WAF = application-layer request filtering (injection, bots). Shield = network-layer DDoS protection. Use both together.

Sources

Open the SysPad canvas · Official AWS WAF documentation