Learn
AWS
Security, identity & compliance
WAF

AWSGCP laterAzure later

WAFAWS WAF

Security, identity & complianceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

A web application firewall that inspects the HTTP and HTTPS requests reaching CloudFront, a load balancer or an API, and allows, blocks or counts each one by your rules.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateLOWSysOps Administrator – AssociateMEDSecurity – SpecialtyHIGH

Where WAF takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Rules for every web request

AWS WAF is a web application firewall. It watches the HTTP and HTTPS requests on their way to a CloudFront distribution, an Application Load Balancer, an API Gateway REST API, an AppSync GraphQL API, a Cognito user pool, an App Runner service, a Verified Access instance or Amplify, and answers each with the content, a 403 Forbidden, or a response of your own.

Rules in a web ACL. A web ACL, also called a protection pack, holds rules that match on where a request comes from and what it carries: IP addresses, country, headers, strings and regex patterns, length, SQL injection and cross-site scripting. Each rule allows, blocks or counts, or asks for a CAPTCHA or a silent challenge.

Reach for it when

a web application must be protected from SQL injection and cross-site scripting
no single client may send more than a set number of requests
requests from some countries or address ranges must be refused
you want rules that AWS writes and keeps up to date

It is the wrong tool when

the traffic reaches a Network Load Balancer: WAF protects none
the threat is a flood at the network and transport layers: Shield Standard already covers everyone

Mental model

The bouncer with a rulebook

A bouncer at a club door with a rulebook. He checks each guest against the rules in order: banned names first, then anyone carrying something forbidden, then anyone who has been in and out too often tonight. The first rule that fits decides; if none does, the house rule applies.

The rulebookrules applied to every requestWeb ACL

One line in the rulebooka match, and what to do with itRule

Pages bought from a security firmrules written and kept up by AWSManaged rule group

The banned listaddresses to always refuseIP set

Too many trips tonighta limit for each client in a windowRate-based rule

The house rulewhat happens when nothing matchesDefault action

How it works

Rules in order, first decision wins

Create a web ACLChoose its default action, Allow or Block, for requests that no rule matches.
Add rules in orderEach rule has a priority; WAF checks them from the lowest number up until a rule allows or blocks the request.
Start with CountCount records what a rule would match without changing how the request is handled, so it can be tested first.
Associate itAttach the web ACL to the distribution, load balancer or API it protects.

Inspects: HTTP and HTTPSweb requests only
Rate window: 1, 2, 5 or 10 min5 minutes by default
Lowest rate limit: 10 requestsin the window
Capacity included: 1,500 WCUs5,000 at most per web ACL
When blocked: 403 Forbiddenor a custom response
Logs go to: Three placesCloudWatch Logs, S3 or Data Firehose

Priority 0: IP set
Is the client's address on this web ACL's list of blocked addresses?
Priority 1: managed rules
Does the request carry SQL injection or other known bad input, as AWS's managed rule groups define it?
Priority 2: rate limit
Has this address sent more than 1,000 requests in the last 5 minutes? That is this web ACL's limit.
Default action
No rule allowed or blocked the request, so the web ACL's default action decides: Allow, here.

Pick a case to follow the request through each check.

Architecture

A web ACL at the edge

The web ACL inspects each request at the CloudFront distribution before it travels on to the load balancer, and its logs show which rules matched.

Filter before the Region. A web ACL on the CloudFront distribution inspects requests before they travel on to the load balancer. A web ACL can sit on the load balancer instead, inspecting them in the Region.

Shield underneath. Shield Standard protects every AWS customer from the common network and transport layer floods at no extra charge. WAF deals with what is inside each request.

Logs to tune the rules. Send the web ACL's logs to CloudWatch Logs, an S3 bucket or Data Firehose to see which rules matched which requests.

Security

Running the rules safely

Test before you block. Put a new rule or managed rule group in Count first; AWS says to test and tune managed rules outside production before using them there.

Geography, with CloudFront. CloudFront's own geo restriction never passes the requests it blocks on to WAF. To block by country together with other conditions, use WAF's geo match rule and not the CloudFront feature.

A country comes from an address. WAF finds it from the request's origin IP, or from a header such as X-Forwarded-For if you configure it to, since a proxy may sit in front.

Managed rules are a layer, not the job. AWS says they add security but do not replace your own responsibilities under the shared responsibility model.

Cost

How you are charged, not what it costs today

A monthly charge for each web ACL, and one for each rule in it.

A charge per million requests inspected.

The extras: the Bot Control and Fraud Control managed rule groups, CAPTCHA and Challenge actions, capacity beyond the 1,500 WCUs included, and inspecting larger request bodies.

Shield Advanced pays the standard WAF charges for the resources it protects.

Prices change, so none are printed here. Check the WAF pricing page on aws.amazon.com.

Comparison

Which protection, which rule

Service	Layer	What it stops	Choose it when
WAF	Application, layer 7	Requests that match your rules	You need rules about what requests contain
Shield Standard	Network and transport, layers 3 and 4	Common DDoS floods, automatically	Always: it is on for everyone at no extra charge
Shield Advanced	Layers 3, 4 and 7	Larger attacks, with a response team and cost protection	A target that is attacked often

Rule	Matches on	For example
IP set	Source IP addresses	Block a known bad range
Geo match	Country, from the IP address	Allow only the countries you sell to
Rate-based	Requests per client in a window	Block an address after 100 requests in 5 minutes
Managed rule group	Threats AWS keeps up to date	SQL injection, known bad inputs
String or regex match	Headers, query strings, bodies	Block requests for an admin path

SAA traps

The phrase in the question, and what it means

block SQL injection and cross-site scriptingWAF

It inspects requests for SQL code and scripts that are likely to be malicious.

limit each IP address to a number of requests in 5 minutesA rate-based rule

It counts each address's requests over 1, 2, 5 or 10 minutes and acts on those past the limit.

put WAF in front of a Network Load BalancerNot possible

WAF protects CloudFront, ALB, API Gateway REST APIs, AppSync and a few others, but not an NLB.

try a new rule without affecting real usersThe Count action

It records matches and leaves the handling unchanged.

block some countries, except a partner's addresses in themGeo match combined with an IP set

WAF can join conditions with AND and NOT; CloudFront's geo restriction cannot.

protection from common web exploits without writing rulesAWS Managed Rules

Rule groups such as the core rule set and known bad inputs, kept up to date by AWS.

slow bots down instead of blocking them outrightCAPTCHA or Challenge

Both check requests to cut bot traffic, CAPTCHA with a puzzle and Challenge silently.

a flood of packets at the network layerShield, not WAF

Network and transport layer floods are Shield Standard's job, and it is automatic.

the same WAF rules in every account of the organizationFirewall Manager

It applies WAF and Shield Advanced protections across accounts, including new ones.

Scenario

Exam style, marked when you answer

A retailer serves its site through CloudFront to an Application Load Balancer. Its logs show SQL injection attempts, and a few addresses send thousands of requests a minute to the login page. It wants protection against common exploits that AWS keeps up to date, a limit on each address, and a way to test both before they block anyone. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

Shoppers reach an online shop through an Application Load Balancer. Attackers try SQL injection in the search box, and some addresses send thousands of requests a minute. Something must inspect each HTTP request, block the injection with rules AWS keeps up to date, and limit each address. What inspects the requests?

Web client· ShoppersPick a service belowALB· Load balancerEC2 Auto Scaling· Web servers

Quick revision

The night before the exam

What: A web application firewall for HTTP and HTTPS requests.
Attaches to: CloudFront, ALB, API Gateway REST, AppSync, Cognito and more; never an NLB.
Order: By priority, lowest first; the first Allow or Block decides.
Actions: Allow, Block, Count, CAPTCHA, Challenge.
Rate-based: Per client, over 1, 2, 5 or 10 minutes, a limit of 10 or more.
Managed rules: Core rule set, known bad inputs, SQL database, IP reputation.
Capacity: 1,500 WCUs included, 5,000 at most.
Geo: WAF's geo match joins other rules; CloudFront's geo restriction cannot.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.