AWS WAF Explained: Web ACLs, Rules, Managed Rule Groups आणि Actions

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचे उदाहरण

Priya Deshmukh (पुणे) /login वर 40k hits. SG = HTTP समजत नाही. Shield Standard = volumetric. WAF = URI rate + CAPTCHA + SQLi Block — Layer 7.

CDN/HTTPS: CloudFront आणि WAF survey. इथे WAF deep-dive.

2. AWS WAF का?

हे का लागतं?

Attackers HTTP बोलतात — SQLi, XSS, stuffing, scrapers, unwanted geo. Network = packets; WAF = abusive requests.

• OWASP-style आधी थांबवा
• App rewrite न करता rate-limit
• एक ACL → अनेक resources
• Count → Block
• Logs → SIEM

3. Web ACL काय आहे?

हे काय आहे?

Web ACL = default action + ordered rules + visibility. Scope: REGIONAL किंवा CLOUDFRONT (us-east-1).

Building blocks

4. Rules आणि statements

Rule = name + priority + action + statement. Match, rate-based, AND/OR/NOT, rule-group ref.

• ByteMatch — URI/header/body/query
• GeoMatch — country
• IP set
• SQLi / XSS
• Rate-based 5-min
• Label match

5. Rule groups आणि AWS Managed Rules

Rule groups = bundle. AWS Managed: CRS, Bad Inputs, SQLi, OS, WordPress, Bot Control, ATP… Marketplace ही.

6. Priority क्रम

छोटा number आधी. Terminating (Allow/Block/CAPTCHA/Challenge) थांबवतो. Count चालू ठेवतो. Default = काही terminate न झाल्यास.

# Example priority map (document this in every PR)
# 10  - Block office-banned IP set
# 100 - Allow /health from ALB health checkers
# 200 - Allow partner webhook IPs on /hooks/*
# 500 - AWSManagedRulesCommonRuleSet (Count→Block)
# 510 - AWSManagedRulesSQLiRuleSet
# 900 - Rate-based 2000 req/5min per IP on /login
# default - Allow

7. Actions

CAPTCHA/Challenge = tokens. Pure API = Block/rate — SDK CAPTCHA नसेल तर break.

8. Custom responses

Block वर custom code/body (429 HTML/JSON). Flash sale branded page.

9. Multi-industry

• Fintech: CAPTCHA + /otp rate
• Healthcare: CRS + geo
• EdTech: Challenge
• Gov: CRS + CAPTCHA
• Gaming: Bot + rate

10. Lab: Web ACL वाचा आणि explain करा

कसं करायचं (step by step)

1. Console → Web ACL.
2. Default + priorities.
3. CRS in Count.
4. Sampled.
5. PR blurb.

Cleanup

1. Remove managed.
2. Delete ACL.

11. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

12. Troubleshooting checklist

1. Scope check.
2. Sampled requests.
3. Priority order.
4. curl -v.
5. Log ruleId.
6. CF region.
7. ALB ARN.
8. Shield health.

13. FAQ

14. Interview Q&A

15. Tips — English, मराठी आणि हिंदी

16. Publish करण्याआधी WAF checklist

1. Threat एका वाक्यात.
2. Global vs regional scope.
3. Default action.
4. Priority bands.
5. Count first.
6. CAPTCHA for humans.
7. Logging first.
8. Allow + 403 tests.
9. On-call owner.
10. CF+WAF survey link.

17. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

18. Interview-friendly priority bands

• 0–99: emergency Block
• 100–199: Allow exceptions
• 200–499: geo/bot
• 500–799: Managed Rules
• 800–899: custom
• 900–999: rate-based

छोटा number = उच्च priority. पहिला terminating action जिंकतो. Count terminate होत नाही.

19. Industry story bank

एकच WAF pattern; फक्त IP/geo/URI/rate बदला.

• Fintech: /login /otp rate + CAPTCHA.
• Healthcare: geo + SQLi.
• EdTech: Challenge scrapers.
• Ecommerce: Bot + 429.
• Media: search rate.
• SaaS: webhook allowlist.
• Logistics: geo + rate.
• Gov: CRS + CAPTCHA.
• Gaming: Shield + rate.
• Travel: geo + card-test block.

20. False-positive unlock runbook

1. Sampled / logs → rule id.
2. curl -v reproduce.
3. Block→Count.
4. Narrow Allow above.
5. Label exclusions.
6. Retest + ticket.
7. Default Allow + empty नको.

21. PR review checklist

• Correct scope.
• Priority table.
• Count → Block date.
• Logs encrypted.
• 200 + 403 proofs.
• Survey link.
• Shield decision.

22. या site वरील related chapters

• CF+WAF survey: chapter
• Well-Architected — पुढचा.
• S3 policy projects.

23. Metric आणि alarm starter pack

Day-one alarms. Thresholds = starting points.

• BlockedRequests spike
• CountedRequests review
• ALB 5xx
• ASG at max
• DDoSDetected
• CF error rate
• R53 unhealthy
• Log delivery

24. Sampled requests वाचन

1. Sampled → rule.
2. Action/URI/country.
3. TP/FP/CAPTCHA.
4. Request ids → ticket.
5. Samples+logs.

25. Glossary

26. 15-minute tabletop

1. Scenario inject.
2. Classify.
3. First clicks + page.
4. Comms.
5. Gap note.

27. Cost notes

WAF = ACL+rules+requests; Bot/ATP जास्त. Shield Advanced = monthly+usage. Logs = storage. Budgets ठेवा.

28. WAF पलीकडे hygiene

• No CF bypass.
• IAM least privilege.
• Log bucket BPA.
• Quarterly IP/geo.
• Redact secrets.
• Break-glass doc.

29. इतर chapters शी pairing

Origin OAC = S3 projects. Security pillar = Well-Architected. CDN/HTTPS = CF+WAF survey.

30. Request flow deep dive

Browser → R53 → CF → WAF → (ALB WAF) → app. Shield पहातो. Logs → SOC.

1. DNS+TLS (Shield).
2. Edge WAF.
3. Cache.
4. Origin + regional WAF.
5. ASG serve.
6. Metrics/logs/SRT.

31. Rule JSON anatomy

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

32. Text transformations

• LOWERCASE
• URL_DECODE
• HTML_ENTITY_DECODE
• CMD_LINE
• Compress/Strip
• Ordered transforms

33. Office-hours drills

1. Drill 1 Count.
2. Drill 2 priority.
3. Drill 3 curl.
4. Drill 4 Shield.
5. Drill 5 runbook.
6. Drill 6 region.
7. Drill 7 order.
8. Drill 8 redact.

34. Change calendar

• Day 0
• Day 1
• Day 2–3
• Day 4
• Day 5
• Day 7
• Day 14
• Day 30

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.