Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
A web application firewall that inspects the HTTP and HTTPS requests reaching CloudFront, a load balancer or an API, and allows, blocks or counts each one by your rules.
Where WAF takes you5 steps, all open
AWS WAF is a web application firewall. It watches the HTTP and HTTPS requests on their way to a CloudFront distribution, an Application Load Balancer, an API Gateway REST API, an AppSync GraphQL API, a Cognito user pool, an App Runner service, a Verified Access instance or Amplify, and answers each with the content, a 403 Forbidden, or a response of your own.
Rules in a web ACL. A web ACL, also called a protection pack, holds rules that match on where a request comes from and what it carries: IP addresses, country, headers, strings and regex patterns, length, SQL injection and cross-site scripting. Each rule allows, blocks or counts, or asks for a CAPTCHA or a silent challenge.
A bouncer at a club door with a rulebook. He checks each guest against the rules in order: banned names first, then anyone carrying something forbidden, then anyone who has been in and out too often tonight. The first rule that fits decides; if none does, the house rule applies.
Web ACLRuleManaged rule groupIP setRate-based ruleDefault actionIs the client's address on this web ACL's list of blocked addresses?
Does the request carry SQL injection or other known bad input, as AWS's managed rule groups define it?
Has this address sent more than 1,000 requests in the last 5 minutes? That is this web ACL's limit.
No rule allowed or blocked the request, so the web ACL's default action decides: Allow, here.
Pick a case to follow the request through each check.
Filter before the Region. A web ACL on the CloudFront distribution inspects requests before they travel on to the load balancer. A web ACL can sit on the load balancer instead, inspecting them in the Region.
Shield underneath. Shield Standard protects every AWS customer from the common network and transport layer floods at no extra charge. WAF deals with what is inside each request.
Logs to tune the rules. Send the web ACL's logs to CloudWatch Logs, an S3 bucket or Data Firehose to see which rules matched which requests.
Test before you block. Put a new rule or managed rule group in Count first; AWS says to test and tune managed rules outside production before using them there.
Geography, with CloudFront. CloudFront's own geo restriction never passes the requests it blocks on to WAF. To block by country together with other conditions, use WAF's geo match rule and not the CloudFront feature.
A country comes from an address. WAF finds it from the request's origin IP, or from a header such as X-Forwarded-For if you configure it to, since a proxy may sit in front.
Managed rules are a layer, not the job. AWS says they add security but do not replace your own responsibilities under the shared responsibility model.
A monthly charge for each web ACL, and one for each rule in it.
A charge per million requests inspected.
The extras: the Bot Control and Fraud Control managed rule groups, CAPTCHA and Challenge actions, capacity beyond the 1,500 WCUs included, and inspecting larger request bodies.
Shield Advanced pays the standard WAF charges for the resources it protects.
Prices change, so none are printed here. Check the WAF pricing page on aws.amazon.com.
| Service | Layer | What it stops | Choose it when |
|---|---|---|---|
| WAF | Application, layer 7 | Requests that match your rules | You need rules about what requests contain |
| Shield Standard | Network and transport, layers 3 and 4 | Common DDoS floods, automatically | Always: it is on for everyone at no extra charge |
| Shield Advanced | Layers 3, 4 and 7 | Larger attacks, with a response team and cost protection | A target that is attacked often |
| Rule | Matches on | For example |
|---|---|---|
| IP set | Source IP addresses | Block a known bad range |
| Geo match | Country, from the IP address | Allow only the countries you sell to |
| Rate-based | Requests per client in a window | Block an address after 100 requests in 5 minutes |
| Managed rule group | Threats AWS keeps up to date | SQL injection, known bad inputs |
| String or regex match | Headers, query strings, bodies | Block requests for an admin path |
block SQL injection and cross-site scriptingWAF
It inspects requests for SQL code and scripts that are likely to be malicious.
limit each IP address to a number of requests in 5 minutesA rate-based rule
It counts each address's requests over 1, 2, 5 or 10 minutes and acts on those past the limit.
put WAF in front of a Network Load BalancerNot possible
WAF protects CloudFront, ALB, API Gateway REST APIs, AppSync and a few others, but not an NLB.
try a new rule without affecting real usersThe Count action
It records matches and leaves the handling unchanged.
block some countries, except a partner's addresses in themGeo match combined with an IP set
WAF can join conditions with AND and NOT; CloudFront's geo restriction cannot.
protection from common web exploits without writing rulesAWS Managed Rules
Rule groups such as the core rule set and known bad inputs, kept up to date by AWS.
slow bots down instead of blocking them outrightCAPTCHA or Challenge
Both check requests to cut bot traffic, CAPTCHA with a puzzle and Challenge silently.
a flood of packets at the network layerShield, not WAF
Network and transport layer floods are Shield Standard's job, and it is automatic.
the same WAF rules in every account of the organizationFirewall Manager
It applies WAF and Shield Advanced protections across accounts, including new ones.
A retailer serves its site through CloudFront to an Application Load Balancer. Its logs show SQL injection attempts, and a few addresses send thousands of requests a minute to the login page. It wants protection against common exploits that AWS keeps up to date, a limit on each address, and a way to test both before they block anyone. What should a solutions architect do?
Shoppers reach an online shop through an Application Load Balancer. Attackers try SQL injection in the search box, and some addresses send thousands of requests a minute. Something must inspect each HTTP request, block the injection with rules AWS keeps up to date, and limit each address. What inspects the requests?
1, 2, 5 or 10 minutes, a limit of 10 or more.1,500 WCUs included, 5,000 at most.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.