AWS WAF
- What it is
- Web Application Firewall. Filters HTTP/HTTPS requests at Layer 7 before they reach your application.
- Deploys on Amazon CloudFront, Application Load Balancer, Amazon API Gateway, AWS AppSync, and Cognito user pools.
- What it blocks
- SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks.
- Rate-based rules to throttle abusive IPs, geo-blocking, bot control, account takeover prevention.
- AWS Managed Rules give you maintained rule sets without writing your own.
- Not to be confused with
- AWS Shield — DDoS protection at Layers 3/4 (volumetric floods). WAF inspects request content.
- security groups / network ACLs — Layer 3/4 IP and port filtering inside a VPC; they cannot see the HTTP request.
- AWS Network Firewall — Layer 3/4 (with some L7) stateful inspection for all VPC traffic, not just web apps.