AWS WAF Hands-On: Rate Rules, IP Sets, Geo, SQLi/XSS, Logging and Attachments

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday lab story

Kochi clinic portal (Priya Nair) runs behind an ALB in ap-south-1. Tonight we put a REGIONAL Web ACL on that ALB: office IP Allow, geo IN+AE, CRS+SQLi in Count then Block, rate 1000/5min on /login, custom 429 page, logs to S3. Nairobi booking API (Amina Okello) will reuse the same pattern on API Gateway.

For CloudFront attachment theory and HTTPS/OAC, open CloudFront and WAF survey.

2. Why hands-on matters

Why do we need this?

Console screenshots fade. A curl 403 in your notes proves the Block path. Logging proves you can forensics. Attachment mistakes (wrong scope/region) are the #1 silent failure.

3. What you will build

What is it?

1. IP set for office /32 addresses
2. Geo match statement for IN and AE
3. Rate-based rule on /login
4. AWS Managed SQLi + CRS (Count→Block)
5. Custom response 403/429 body
6. Associate to ALB (and notes for API GW, CF, AppSync, Cognito)
7. Logging to S3 (and Firehose/CW options)
8. curl allow 200 + attack 403

4. How: IP set + geo + rate

How to do it (step by step)

export AWS_REGION=ap-south-1
export NAME=rb-waf-handson-$(date +%s)

aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32 198.51.100.20/32
# note Id + LockToken from output

# rules.json sketch (priorities):
# 100 Allow if IPSetReference office
# 200 Block if NOT GeoMatch [IN, AE]   (careful with travel users)
# 500 Managed SQLi Count override
# 510 Managed CRS Count override
# 900 RateBasedStatement Limit=1000 AggregateKeyType=IP
#     scoped down with ByteMatch /login in ScopeDownStatement

Rate-based aggregate keys: IP (default), forwarded IP (use with caution + fallback), HTTP method, query argument, header, cookie, label namespace. Pick the key that matches the abuse (credential stuffing → IP or username label).

5. SQLi and XSS managed rules

Prefer AWSManagedRulesSQLiRuleSet and XSS-related rules inside CRS over hand-rolled regex. Start in Count. Inspect sampled requests for false positives on rich text fields (Fatima Khan’s newsroom CMS in Dubai often needs exclusions on /admin/editor).

6. Custom responses

# Custom response body on the Web ACL, then reference from a Block action
# Example: 429 with JSON {"error":"slow_down","retry_after":60}
# Console: Web ACL → Custom response bodies → Add
# Or CLI create-web-acl / update-web-acl with CustomResponseBodies map

7. Attach to every supported resource

# ALB
aws wafv2 associate-web-acl --web-acl-arn "$WEB_ACL_ARN" --resource-arn "$ALB_ARN" --region $AWS_REGION

# CloudFront (ACL must already exist in us-east-1 with --scope CLOUDFRONT)
aws cloudfront get-distribution-config --id E123 > /tmp/d.json
# set WebACLId to ACL ARN, raise ETag IfMatch, update-distribution

8. Logging to S3, CloudWatch Logs, Firehose

put-logging-configuration accepts destinations: S3 bucket (prefix AWSLogs/…), CloudWatch Logs log group (aws-waf-logs-*), or Kinesis Data Firehose (aws-waf-logs-*). Bucket/Firehose/log group names must start with aws-waf-logs- for some destinations — check current docs for your destination type. Encrypt with KMS where required and keep a lifecycle policy.

aws wafv2 put-logging-configuration --region $AWS_REGION --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN,RedactedFields=[]
# Then: aws s3 ls s3://aws-waf-logs-rb-lab/ --recursive | tail

9. Test with curl (200 and 403)

# ALLOW — normal homepage
curl -s -o /dev/null -w "%{http_code}\n" https://clinic.example.com/
# 200

# BLOCK — classic SQLi probe (after SQLi rules are in Block mode)
curl -s -o /dev/null -w "%{http_code}\n" \
  "https://clinic.example.com/search?q=1%27%20OR%20%271%27%3D%271"
# 403

# RATE — hammer /login from one IP (lab only)
for i in $(seq 1 1200); do curl -s -o /dev/null https://clinic.example.com/login & done
wait
curl -s -o /dev/null -w "%{http_code}\n" https://clinic.example.com/login
# 403 (once rate key exceeds Limit)

10. Multi-industry attachments

• Fintech (Arjun Mehta): API Gateway + rate /otp + Firehose → SIEM
• Ecommerce (Lucas Meyer): CloudFront ACL + Bot Control + 429 HTML
• SaaS (Ananya Iyer): ALB + IP allow /hooks + CW Logs
• EdTech (Sofia Alvarez): CloudFront + Challenge on /courses
• Gov (Rahul Deshmukh): ALB + Cognito hosted UI WAF + S3 logs

11. Lab: ALB Web ACL with rate + SQLi + S3 logs

Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.

How to do it (step by step)

1. Create REGIONAL Web ACL in ap-south-1 with default Allow.
2. Add office IP Allow (prio 100), geo optional, SQLi managed Count (500), rate /login 1000 (900).
3. Associate to a lab ALB; enable S3 logging.
4. curl homepage → 200; SQLi URL → (after Block flip) 403; save outputs.
5. Flip SQLi Count→Block after reviewing sampled requests.

Cleanup (stop billing)

1. Disassociate Web ACL from ALB.
2. Delete logging config; empty log bucket prefixes.
3. Delete Web ACL, IP sets, lab ALB if dedicated.

12. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

13. Troubleshooting checklist

1. Confirm Web ACL scope matches resource type.
2. Open Sampled requests for the last 3 hours.
3. Diff priorities: is an Allow above your Block?
4. curl -v with and without the attack payload.
5. Check WAF logs in S3/Firehose for ruleId and action.
6. For CloudFront: confirm us-east-1 Web ACL and distribution id.
7. For ALB: confirm association ARN equals the listener’s load balancer.
8. If Shield Advanced: check protection status and health checks.

14. FAQ

15. Interview Q&A

16. Tips in English, Marathi and Hindi

17. ScopeDown and nested statements

Rate-based and managed groups can use a ScopeDownStatement so only /login or only application/json bodies are inspected. Nest AND/OR/NOT carefully — test with Count. Nested depth has service limits; prefer labels over deep trees.

# Pseudo rule: rate only on /login POST
RateBasedStatement:
  Limit: 1000
  AggregateKeyType: IP
  ScopeDownStatement:
    AndStatement:
      Statements:
        - ByteMatchStatement: {SearchString: /login, FieldToMatch: UriPath, ...}
        - ByteMatchStatement: {SearchString: POST, FieldToMatch: Method, ...}

18. Bot Control and Account Takeover notes

AWS WAF Bot Control (common/targeted) and Account Takeover Prevention are managed add-ons with extra cost. Use Targeted Bot Control when scrapers ignore robots.txt (Sofia Alvarez LMS). Use ATP on /login /signup for credential stuffing (Arjun Mehta fintech). Still start in Count.

19. IAM for WAF deploy roles

• wafv2:CreateWebACL / UpdateWebACL / DeleteWebACL on lab resources
• wafv2:AssociateWebACL / DisassociateWebACL
• wafv2:PutLoggingConfiguration + S3/Firehose permissions on destinations
• iam:CreateServiceLinkedRole for WAF logging when first used
• Deny wafv2:DeleteWebACL without tag Environment=lab in production accounts

20. End-to-end allow/deny matrix

21. WAF design checklist before you publish

1. Write the threat in one sentence (bot scrape, SQLi, credential stuffing, country block).
2. Choose scope: CloudFront (global) vs regional (ALB/API GW/AppSync).
3. List default action: Allow with Block rules, or Block with Allow exceptions.
4. Decide priority bands: 0–99 emergency, 100–499 allowlists, 500–899 managed, 900+ rate.
5. Start risky new rules in Count for 24–72 hours, then flip to Block.
6. Plan CAPTCHA/Challenge only where a human can solve them (not pure APIs).
7. Enable logging to S3 or Firehose before the first Block go-live.
8. Document the curl allow test and the 403 deny test.
9. Name the owner on-call for false-positive unlocks.
10. Link back to the CloudFront+WAF survey chapter for CDN/HTTPS basics.

22. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

23. Priority bands that interviewers love

• 0–99: emergency Block / IP denylist (fastest kill switch)
• 100–199: explicit Allow for partners / health checks / office IP
• 200–499: geo / ASN / bot control early filters
• 500–799: AWS Managed Rules (SQLi, XSS, WordPress, Linux, Windows)
• 800–899: custom body / header / URI matches
• 900–999: rate-based rules (last line before default)

Lower number = higher priority. First matching terminating action wins. Count never terminates — evaluation continues.

24. Industry story bank (reuse the pattern)

Use the same WAF pattern across industries — only change IP sets, geo lists, URI paths, and rate thresholds.

• Fintech (Arjun Mehta, UPI wallet, Mumbai): rate-limit /login and /otp; CAPTCHA on password reset.
• Healthcare (Priya Nair, clinic portal, Kochi): geo allow India+UAE; Block SQLi on /api/patients.
• EdTech (Sofia Alvarez, LMS, Bogotá): Challenge on scraping /courses; Allow CDN health.
• Ecommerce (Lucas Meyer, D2C, Berlin): Bot Control on flash-sale; custom 429 HTML.
• Media (Fatima Khan, newsroom, Dubai): rate on /search; Block known bad ASNs.
• SaaS (Ananya Iyer, B2B CRM, Bengaluru): IP allow partner webhooks; Block rest on /hooks.
• Logistics (Kenji Watanabe, fleet API, Tokyo): geo Japan+SG; rate on /track.
• Government (Rahul Deshmukh, state portal, Nagpur): managed Core Rule Set + CAPTCHA on forms.
• Gaming (Mei Chen, matchmaking API, Singapore): Shield Advanced + WAF rate on /join.
• Travel (Amina Okello, booking, Nairobi): geo allow Africa+EU partners; Block card-testing paths.

25. False-positive unlock runbook

1. Find the blocked request in Sampled requests or WAF logs (rule id + label).
2. Reproduce with curl -v and the same headers/body.
3. If Count would have been enough, flip Block→Count for that rule only.
4. Add a narrow Allow rule at higher priority (specific URI + IP) rather than disabling the whole managed group.
5. Label-match exclusions inside managed rule groups when AWS supports them for that group.
6. Re-test allow and deny paths; leave a ticket with request id.
7. Never set default action to Allow and delete all rules under pressure.

26. What good looks like in a PR review

• Scope (REGIONAL vs CLOUDFRONT) matches the resource.
• Priorities documented in a table in the PR.
• New managed rules started in Count with a flip date.
• Logging destination exists and is encrypted.
• curl 200 and curl 403 proofs pasted.
• Link to CloudFront+WAF survey for CDN/TLS context.
• Shield Advanced decision recorded (yes/no + reason).

27. Related chapters on this site

• CloudFront + WAF survey (CDN, HTTPS, light WAF): open chapter
• Well-Architected Framework (security pillar context): next chapter after this series.
• S3 bucket policy projects (origin hardening behind OAC).

28. Metric and alarm starter pack

Create these CloudWatch alarms on day one so an attack is not a Slack surprise. Thresholds are starting points — tune per app.

• WAF BlockedRequests Sum > N for 5 minutes on the Web ACL metric
• WAF CountedRequests Sum high on a rule still in Count (review before flip)
• ALB HTTPCode_Target_5XX_Count spike
• ASG GroupInServiceInstances at MaxSize for 10 minutes
• Shield Advanced DDoSDetected = 1 (if subscribed)
• CloudFront 4xx/5xx error rate
• Route 53 health check Unhealthy
• WAF logging delivery errors (Firehose throttles)

29. Sampled requests reading guide

1. Open Web ACL → Sampled requests → pick a rule.
2. Note action (Count/Block), URI, country, and matched data.
3. Decide: true positive (keep Block), false positive (Count or exclude), or need CAPTCHA.
4. Export request ids into the ticket for auditors.
5. Never tune only from memory — tune from samples + logs.

30. WAF + Shield glossary (exam friendly)

31. Fifteen-minute tabletop script

1. Minute 0–2: Inject scenario (“CF 5xx + Shield metric up” or “login 403 storm”).
2. Minute 2–5: Classify L3/L4 vs L7; name the runbook.
3. Minute 5–10: Say aloud the first three console clicks + who to page.
4. Minute 10–13: Customer comms one-liner.
5. Minute 13–15: Note one gap to fix in the real runbook.

32. Cost notes (approximate mindset)

WAF charges for Web ACLs, rules, and request units; Bot Control/ATP add-ons cost more. Shield Advanced has a monthly org fee plus data-transfer related charges — confirm on the AWS pricing page the day you buy. Logging to Firehose/S3/CW adds storage and throughput cost. Always set budgets.

33. Security hygiene beyond WAF

• Lock origins so clients cannot bypass CloudFront (SG, OAC, custom header).
• Least-privilege IAM for wafv2:* on deploy roles.
• Encrypt log buckets; block public access on log buckets.
• Quarterly review of IP sets and geo lists (people travel; offices move).
• Redact Authorization and cookie headers in WAF logs.
• Keep a break-glass Allow rule documented but disabled.

34. Pairing with other AWS chapters on this site

Read S3 policy projects when hardening origins behind OAC. Read Well-Architected (next after this series) for the security pillar checklist. Read the CloudFront+WAF survey when you need CDN caching and HTTPS step-by-step.

35. Request flow deep dive (teacher board)

A browser hits https://app.example.com/login. DNS (Route 53) returns CloudFront. TLS ends at CloudFront. WAF Web ACL (CLOUDFRONT, us-east-1) evaluates rules by priority. A Count rule on CRS may label the request. A rate-based rule may Block with 403. If Allow, CloudFront cache or origin fetch runs. Origin ALB may have a second REGIONAL Web ACL. Shield watches volumetric patterns the whole time. Logs land in S3/Firehose for the SOC.

1. DNS resolve and TLS handshake (Shield sees floods here).
2. WAF evaluation at edge (L7).
3. Cache hit/miss at CloudFront.
4. Origin request to ALB; optional regional WAF.
5. ASG target serves app; health checks continue.
6. Metrics + logs + optional SRT.

36. Rule JSON anatomy (read aloud)

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

37. Text transformations cheat sheet

• LOWERCASE — normalise path/header compares
• URL_DECODE / URL_DECODE_UNI — catch encoded probes
• HTML_ENTITY_DECODE — body HTML tricks
• CMD_LINE — OS command obfuscation (with care)
• Compress whitespace / Strip — reduce bypass noise
• Apply in priority order inside the rule

38. Office-hours mini drills (students)

1. Drill 1: Explain why Count does not stop later rules (2 minutes).
2. Drill 2: Given priorities 10 Block IP, 100 Allow /health, 500 CRS — what happens to office IP hitting /health?
3. Drill 3: Write curl that should 403 under SQLi Block.
4. Drill 4: Name three Shield Advanced-only features.
5. Drill 5: Sketch Runbook B first three steps from memory.
6. Drill 6: Where must a CloudFront Web ACL be created?
7. Drill 7: Who wins — managed Block vs later Allow at higher number?
8. Drill 8: Redact which headers in WAF logs for a bank?

39. Change calendar (safe rollout)

• Day 0: ACL + logging + Allow default + health Allow rule
• Day 1: Managed groups in Count
• Day 2–3: Review sampled; add exclusions
• Day 4: Flip SQLi/CRS to Block off-peak
• Day 5: Rate-based on /login in Count then Block
• Day 7: CAPTCHA on password reset only
• Day 14: Firewall Manager baseline if org-ready
• Day 30: Tabletop + Advanced decision revisit

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.