AWS WAF

A service that blocks unauthorized web access via rules.

A service that controls malicious requests to web applications via rules. Integrates with CloudFront and ALB.

• SQL injection mitigation
• Controlling bots and high-volume access
• Protecting CloudFront-distributed sites

• A firewall that protects web applications
• Integrates with CloudFront and ALB
• Managed rules are available

• Use rate-based rules to throttle high-volume access
• When attached to CloudFront, scope is global
• Compare cost against protection coverage

AWS WAF (Web Application Firewall) is a managed firewall service that detects and blocks malicious requests against web applications based on rules. It evaluates requests such as SQL injection, cross-site scripting (XSS), large volumes of requests from specific IP addresses, and access from specific geographic regions according to the configured rules. WAF does not operate on its own; instead, it is deployed by being associated with a protected resource such as CloudFront, Application Load Balancer (ALB), API Gateway, or AWS AppSync. Three types of rules are available: managed rules (rule sets provided by AWS or AWS Marketplace partners), custom rules (where conditions are written by the user), and rate-based rules (which block based on request counts within a given time window). Managed rules include frequently used rule sets such as OWASP Top 10 protection, bot management, and protection against known malicious IPs, and basic protection can be initiated simply by enabling them. These are bundled as rule groups within a Web ACL (Access Control List), and the Web ACL is then associated with the protected resource. Pricing is based on a combination of the number of Web ACLs, the number of rules, and the number of processed requests, with additional charges per managed rule group. The relationship with AWS Shield Standard should also be kept in mind: Shield Standard provides L3/L4 DDoS protection to all AWS users at no cost, while WAF handles rule-based defense at L7 (HTTP/HTTPS). Because the two cover different domains, using WAF together with Shield Standard is the baseline approach for protecting web applications. In CLF-C02, framings such as WAF as L7 web application protection, integration with CloudFront and ALB, and the ability to defend against SQL injection and XSS through managed rules are frequent topics.

• What is AWS WAF (AWS Official Documentation)
• AWS WAF (AWS Official)

Last updated: 2026-06-01