AWS WAF Popular2015年〜
A firewall service that protects web applications from malicious traffic
What It Does
AWS WAF (Web Application Firewall) protects web applications from common attacks like SQL injection, cross-site scripting (XSS), and DDoS. It sits in front of CloudFront, API Gateway, and Application Load Balancer to block malicious requests. Custom rules let you filter by IP address, request headers, request body, and more.
Use Cases
Defending web applications against vulnerability exploits, blocking bot traffic, restricting access from specific countries or IP addresses, rate-based DDoS mitigation, and preventing API abuse.
Everyday Analogy
Think of a building security guard. The guard (WAF) checks visitors (requests) at the entrance, denying entry to suspicious individuals (malicious requests). People on the blacklist (IP block) are immediately turned away, and those carrying dangerous items (attack code) found during inspection (request content inspection) are also blocked.
What Is WAF?
AWS WAF is a managed firewall service that detects and blocks attacks against web applications. While traditional network firewalls control traffic by IP address and port number, WAF inspects HTTP request content (URL, headers, body) to defend against application-layer attacks. It integrates with AWS services and can be deployed in minutes.
Rules and Rule Groups
WAF rules combine inspection conditions with actions (allow, block, count). AWS-provided managed rule groups include rules for OWASP Top 10 vulnerabilities, known malicious IP address lists, and bot mitigation - enabling basic protection without security expertise. You can also create custom rules for application-specific requirements.
Rate-Based Rules
Rate-based rules automatically block IP addresses that exceed a request threshold. For example, you can block IPs that send more than 2,000 requests in 5 minutes. This mitigates DDoS attacks and brute-force password attacks. For technical background on rate-based rules, related books on Amazon are a useful resource.
Getting Started
Create a Web ACL (Access Control List) in the WAF console. Select the resource to protect (CloudFront, ALB, API Gateway) and add managed rule groups. Simply adding the AWS Managed Rules Core Rule Set enables basic protection against common web attacks.
Things to Watch Out For
- WAF rules are billed per Web ACL, so costs increase as you add more rules
- Managed rules are updated regularly but may cause false positives (blocking legitimate requests). Use count mode initially to verify behavior
- WAF alone doesn't provide complete protection - also implement application-level security measures (input validation, parameterized queries, etc.)
