AWS WAF Explained: Web ACLs, Rules, Managed Rule Groups and Actions

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday example

Pune bakery site of Priya Deshmukh suddenly sees 40k hits/minute on /login from one ASN. Security Groups cannot parse HTTP. Shield Standard absorbs some volumetric noise. WAF is the tool that can rate-limit that URI, CAPTCHA the browser, and Block the SQLi string in the query — at Layer 7.

CDN and HTTPS setup live in the survey chapter: Amazon CloudFront and WAF. Here we go deep on WAF itself.

2. Why AWS WAF?

Why do we need this?

Attackers speak HTTP. They send SQLi in query strings, XSS in bodies, credential stuffing on /login, scrapers on /api/catalog, and geo floods from regions you never sell to. Network controls stop packets; WAF stops abusive requests.

• Stop OWASP-style web attacks before they hit the origin
• Rate-limit abusive IPs/URIs without rewriting the app
• Centralise web rules for ALB, API Gateway, CloudFront, AppSync, Cognito
• Count first, Block later — reduce false positives
• Feed logs to SIEM for forensics

3. What is a Web ACL?

What is it?

A Web Access Control List is a named container: default action + ordered rules + visibility (CloudWatch metrics + sampled requests). Scope is either REGIONAL (ALB, API Gateway REST/HTTP, AppSync, Cognito user pool) or CLOUDFRONT (must create in us-east-1).

Building blocks

4. Rules and statements

A rule has: name, priority (integer), action or override, visibility config, and a statement tree. Statements include match (byte, regex, geo, IP, size, SQL injection, XSS), rate-based, AND/OR/NOT composites, and rule-group references.

• ByteMatch — exact or substring on URI, header, body, query
• GeoMatch — country codes (ISO)
• IPSetReference — allow/deny lists
• SqliMatch / XssMatch — inspection with sensitivity
• RateBased — requests per 5-minute window per aggregate key
• LabelMatch — react to labels from earlier rules

5. Rule groups and AWS Managed Rules

Rule groups package many rules. You can publish your own for reuse across accounts (with Firewall Manager) or subscribe to AWS Managed Rules: Core Rule Set (CRS), Known Bad Inputs, SQL database, Linux/Windows, WordPress, PHP, Amazon IP reputation, Anonymous IP, Bot Control, Account Takeover Prevention, and more. Vendor groups (marketplace) also exist.

6. Priority order

Lower number runs first. First terminating action (Allow, Block, CAPTCHA, Challenge) stops evaluation. Count is non-terminating — later rules still run. Default action applies only if nothing terminated.

# Example priority map (document this in every PR)
# 10  - Block office-banned IP set
# 100 - Allow /health from ALB health checkers
# 200 - Allow partner webhook IPs on /hooks/*
# 500 - AWSManagedRulesCommonRuleSet (Count→Block)
# 510 - AWSManagedRulesSQLiRuleSet
# 900 - Rate-based 2000 req/5min per IP on /login
# default - Allow

7. Actions: Allow, Block, Count, CAPTCHA, Challenge

CAPTCHA and Challenge mint tokens. Pure machine-to-machine APIs should prefer Block or rate-based — a mobile SDK without CAPTCHA handling will break.

8. Custom responses

On Block you can return a custom HTTP code (e.g. 429) and body (HTML or JSON) from a response key stored on the Web ACL. Useful for branded “slow down” pages during flash sales (Lucas Meyer, Berlin D2C).

9. Multi-industry snapshots

• Fintech UPI (Arjun Mehta): CAPTCHA on password reset; rate on /otp
• Healthcare (Priya Nair, Kochi): CRS + geo IN/AE
• EdTech (Sofia Alvarez): Challenge on /courses scrapers
• Gov portal (Rahul Deshmukh): CRS + CAPTCHA on forms
• Gaming (Mei Chen, Singapore): Bot Control + rate /join

10. Lab: read a Web ACL and explain it

How to do it (step by step)

1. In console open WAFv2 → Web ACLs → pick one (or create empty REGIONAL in ap-south-1).
2. Screenshot default action, each rule priority, and actions.
3. Add AWSManagedRulesCommonRuleSet with Count override.
4. Send 20 benign curls; open Sampled requests.
5. Write a 5-line explanation of evaluation order for your PR template.

Cleanup

1. Remove the managed rule group if this was a lab ACL.
2. Delete the lab Web ACL if unused (disassociate first).

11. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

12. Troubleshooting checklist

1. Confirm Web ACL scope matches resource type.
2. Open Sampled requests for the last 3 hours.
3. Diff priorities: is an Allow above your Block?
4. curl -v with and without the attack payload.
5. Check WAF logs in S3/Firehose for ruleId and action.
6. For CloudFront: confirm us-east-1 Web ACL and distribution id.
7. For ALB: confirm association ARN equals the listener’s load balancer.
8. If Shield Advanced: check protection status and health checks.

13. FAQ

14. Interview Q&A

15. Tips in English, Marathi and Hindi

16. WAF design checklist before you publish

1. Write the threat in one sentence (bot scrape, SQLi, credential stuffing, country block).
2. Choose scope: CloudFront (global) vs regional (ALB/API GW/AppSync).
3. List default action: Allow with Block rules, or Block with Allow exceptions.
4. Decide priority bands: 0–99 emergency, 100–499 allowlists, 500–899 managed, 900+ rate.
5. Start risky new rules in Count for 24–72 hours, then flip to Block.
6. Plan CAPTCHA/Challenge only where a human can solve them (not pure APIs).
7. Enable logging to S3 or Firehose before the first Block go-live.
8. Document the curl allow test and the 403 deny test.
9. Name the owner on-call for false-positive unlocks.
10. Link back to the CloudFront+WAF survey chapter for CDN/HTTPS basics.

17. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

18. Priority bands that interviewers love

• 0–99: emergency Block / IP denylist (fastest kill switch)
• 100–199: explicit Allow for partners / health checks / office IP
• 200–499: geo / ASN / bot control early filters
• 500–799: AWS Managed Rules (SQLi, XSS, WordPress, Linux, Windows)
• 800–899: custom body / header / URI matches
• 900–999: rate-based rules (last line before default)

Lower number = higher priority. First matching terminating action wins. Count never terminates — evaluation continues.

19. Industry story bank (reuse the pattern)

Use the same WAF pattern across industries — only change IP sets, geo lists, URI paths, and rate thresholds.

• Fintech (Arjun Mehta, UPI wallet, Mumbai): rate-limit /login and /otp; CAPTCHA on password reset.
• Healthcare (Priya Nair, clinic portal, Kochi): geo allow India+UAE; Block SQLi on /api/patients.
• EdTech (Sofia Alvarez, LMS, Bogotá): Challenge on scraping /courses; Allow CDN health.
• Ecommerce (Lucas Meyer, D2C, Berlin): Bot Control on flash-sale; custom 429 HTML.
• Media (Fatima Khan, newsroom, Dubai): rate on /search; Block known bad ASNs.
• SaaS (Ananya Iyer, B2B CRM, Bengaluru): IP allow partner webhooks; Block rest on /hooks.
• Logistics (Kenji Watanabe, fleet API, Tokyo): geo Japan+SG; rate on /track.
• Government (Rahul Deshmukh, state portal, Nagpur): managed Core Rule Set + CAPTCHA on forms.
• Gaming (Mei Chen, matchmaking API, Singapore): Shield Advanced + WAF rate on /join.
• Travel (Amina Okello, booking, Nairobi): geo allow Africa+EU partners; Block card-testing paths.

20. False-positive unlock runbook

1. Find the blocked request in Sampled requests or WAF logs (rule id + label).
2. Reproduce with curl -v and the same headers/body.
3. If Count would have been enough, flip Block→Count for that rule only.
4. Add a narrow Allow rule at higher priority (specific URI + IP) rather than disabling the whole managed group.
5. Label-match exclusions inside managed rule groups when AWS supports them for that group.
6. Re-test allow and deny paths; leave a ticket with request id.
7. Never set default action to Allow and delete all rules under pressure.

21. What good looks like in a PR review

• Scope (REGIONAL vs CLOUDFRONT) matches the resource.
• Priorities documented in a table in the PR.
• New managed rules started in Count with a flip date.
• Logging destination exists and is encrypted.
• curl 200 and curl 403 proofs pasted.
• Link to CloudFront+WAF survey for CDN/TLS context.
• Shield Advanced decision recorded (yes/no + reason).

22. Related chapters on this site

• CloudFront + WAF survey (CDN, HTTPS, light WAF): open chapter
• Well-Architected Framework (security pillar context): next chapter after this series.
• S3 bucket policy projects (origin hardening behind OAC).

23. Metric and alarm starter pack

Create these CloudWatch alarms on day one so an attack is not a Slack surprise. Thresholds are starting points — tune per app.

• WAF BlockedRequests Sum > N for 5 minutes on the Web ACL metric
• WAF CountedRequests Sum high on a rule still in Count (review before flip)
• ALB HTTPCode_Target_5XX_Count spike
• ASG GroupInServiceInstances at MaxSize for 10 minutes
• Shield Advanced DDoSDetected = 1 (if subscribed)
• CloudFront 4xx/5xx error rate
• Route 53 health check Unhealthy
• WAF logging delivery errors (Firehose throttles)

24. Sampled requests reading guide

1. Open Web ACL → Sampled requests → pick a rule.
2. Note action (Count/Block), URI, country, and matched data.
3. Decide: true positive (keep Block), false positive (Count or exclude), or need CAPTCHA.
4. Export request ids into the ticket for auditors.
5. Never tune only from memory — tune from samples + logs.

25. WAF + Shield glossary (exam friendly)

26. Fifteen-minute tabletop script

1. Minute 0–2: Inject scenario (“CF 5xx + Shield metric up” or “login 403 storm”).
2. Minute 2–5: Classify L3/L4 vs L7; name the runbook.
3. Minute 5–10: Say aloud the first three console clicks + who to page.
4. Minute 10–13: Customer comms one-liner.
5. Minute 13–15: Note one gap to fix in the real runbook.

27. Cost notes (approximate mindset)

WAF charges for Web ACLs, rules, and request units; Bot Control/ATP add-ons cost more. Shield Advanced has a monthly org fee plus data-transfer related charges — confirm on the AWS pricing page the day you buy. Logging to Firehose/S3/CW adds storage and throughput cost. Always set budgets.

28. Security hygiene beyond WAF

• Lock origins so clients cannot bypass CloudFront (SG, OAC, custom header).
• Least-privilege IAM for wafv2:* on deploy roles.
• Encrypt log buckets; block public access on log buckets.
• Quarterly review of IP sets and geo lists (people travel; offices move).
• Redact Authorization and cookie headers in WAF logs.
• Keep a break-glass Allow rule documented but disabled.

29. Pairing with other AWS chapters on this site

Read S3 policy projects when hardening origins behind OAC. Read Well-Architected (next after this series) for the security pillar checklist. Read the CloudFront+WAF survey when you need CDN caching and HTTPS step-by-step.

30. Request flow deep dive (teacher board)

A browser hits https://app.example.com/login. DNS (Route 53) returns CloudFront. TLS ends at CloudFront. WAF Web ACL (CLOUDFRONT, us-east-1) evaluates rules by priority. A Count rule on CRS may label the request. A rate-based rule may Block with 403. If Allow, CloudFront cache or origin fetch runs. Origin ALB may have a second REGIONAL Web ACL. Shield watches volumetric patterns the whole time. Logs land in S3/Firehose for the SOC.

1. DNS resolve and TLS handshake (Shield sees floods here).
2. WAF evaluation at edge (L7).
3. Cache hit/miss at CloudFront.
4. Origin request to ALB; optional regional WAF.
5. ASG target serves app; health checks continue.
6. Metrics + logs + optional SRT.

31. Rule JSON anatomy (read aloud)

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

32. Text transformations cheat sheet

• LOWERCASE — normalise path/header compares
• URL_DECODE / URL_DECODE_UNI — catch encoded probes
• HTML_ENTITY_DECODE — body HTML tricks
• CMD_LINE — OS command obfuscation (with care)
• Compress whitespace / Strip — reduce bypass noise
• Apply in priority order inside the rule

33. Office-hours mini drills (students)

1. Drill 1: Explain why Count does not stop later rules (2 minutes).
2. Drill 2: Given priorities 10 Block IP, 100 Allow /health, 500 CRS — what happens to office IP hitting /health?
3. Drill 3: Write curl that should 403 under SQLi Block.
4. Drill 4: Name three Shield Advanced-only features.
5. Drill 5: Sketch Runbook B first three steps from memory.
6. Drill 6: Where must a CloudFront Web ACL be created?
7. Drill 7: Who wins — managed Block vs later Allow at higher number?
8. Drill 8: Redact which headers in WAF logs for a bank?

34. Change calendar (safe rollout)

• Day 0: ACL + logging + Allow default + health Allow rule
• Day 1: Managed groups in Count
• Day 2–3: Review sampled; add exclusions
• Day 4: Flip SQLi/CRS to Block off-peak
• Day 5: Rate-based on /login in Count then Block
• Day 7: CAPTCHA on password reset only
• Day 14: Firewall Manager baseline if org-ready
• Day 30: Tabletop + Advanced decision revisit

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.