Amazon WAF FAQs

Q: What is Amazon WAF?

Amazon WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define. These conditions include IP addresses, HTTP headers, HTTP body, URI strings, SQL injection and cross-site scripting.

Q: How does Amazon WAF block or allow traffic?

As the underlying service receives requests for your web sites, it forwards those requests to Amazon WAF for inspection against your rules. Once a request meets a condition defined in your rules, Amazon WAF instructs the underlying service to either block or allow the request based on the action you define.

Q: How does Amazon WAF protect my website or application?

Amazon WAF is tightly integrated with the Application Load Balancer (ALB), Amazon API Gateway, and Amazon AppSync – services that Amazon Web Services customers commonly use to deliver content for their websites and applications. When you use Amazon WAF on regional services, such as Application Load Balancer, Amazon API Gateway, and Amazon AppSync, your rules run in region and can be used to protect internet-facing resources as well as internal resources.

Q: What types of attacks can Amazon WAF help me to stop?

Amazon WAF helps protects your website from common attack techniques like SQL injection and Cross-Site Scripting (XSS). In addition, you can create rules that can block attacks from specific user-agents, bad bots, or content scrapers. See the Amazon WAF Developer Guide for examples.

Q: Can I get a history of all Amazon WAF API calls made on my account for security, operational or compliance auditing?

Yes. To receive a history of all Amazon WAF API calls made on your account, you simply turn on Amazon CloudTrail.

Q: Does Amazon WAF support IPv6?

Yes, support for IPv6 allows the Amazon WAF to inspect HTTP/S requests coming from both IPv6 and IPv4 addresses.

Q: Does IP set match condition for an Amazon WAF Rule support IPv6?

Yes, you can setup new IPv6 match condition(s) for new and existing WebACLs, as per the documentation.

Q: Can I expect to see IPv6 address appear in the Amazon WAF sampled requests where applicable?

Yes. The sampled requests will show the IPv6 address where applicable.

Q: Can I use IPv6 with all Amazon WAF features?

Yes. You will be able to use all the existing features for traffic both over IPv6 and IPv4 without any discernable changes to performance, scalability or availability of the service.

Q: What services does Amazon WAF support?

Amazon WAF can be deployed on the Application Load Balancer (ALB), Amazon API Gateway, and Amazon AppSync. As part of the Application Load Balancer it can protect your origin web servers running behind the ALBs. As part of Amazon API Gateway, it can help secure and protect your REST APIs. As part of Amazon AppSync, it can help secure and protect your GraphQL APIs.

Q: How does Amazon WAF pricing work? Are there any upfront costs?

Amazon WAF charges based on the number of web access control lists (web ACLs) that you create, the number of rules that you add per web ACL, and the number of web requests that you receive. There are no upfront commitments. Amazon WAF charges are in addition to Application Load Balancer (ALB) pricing, Amazon API Gateway pricing, and/or Amazon AppSync pricing.

Q: What is Rate-based Rule in Amazon WAF?

Rate-based Rules are type of Rule that can be configured in Amazon WAF, allowing you to specify the number of web requests that are allowed by a client IP in a trailing, continuously updated, 5 minute period. If an IP address breaches the configured limit, new requests will be blocked until the request rate falls below the configured threshold.

Q: How does a Rate-based rule compare to a regular Amazon WAF Rule?

Rate-based Rules are similar to regular Rules, with one addition: the ability to configure a rate-based threshold. If, for example, the threshold for the Rate-based Rule is set to (say) 2,000, the rule will block all IPs that have more than 2,000 requests in the last 5 minute interval. A Rate-based Rule can also contain any other Amazon WAF Condition that is available for a regular rule.

Q: What does the Rate-based Rule cost?

A Rate-based Rule costs the same as a regular Amazon WAF Rule.

Q: What are the use cases for the Rate-based Rule?

Here are some popular use cases customers can address with Rate-based rules:

• I want to block or count an IP address when that IP address exceeds the configured threshold rate (configurable in web requests per trailing 5 minute period)
• I want to know which IP address are currently being blocked because they exceeded the configured threshold rate
• I want IP addresses that have been added to the block list to be automatically removed when they are no longer violating the configured threshold rate
• I want to exempt certain high-traffic source IP ranges from being blocked by my Rate-based rules
  

Q: Are the existing matching conditions compatible with the Rate-base Rule?

Yes. Rate-based rules are compatible with existing Amazon WAF match conditions. This allows you to further refine your match criteria and limit rate-based mitigations to specific URLs of your website or traffic coming from specific referrers (or user agents) or add other custom match criteria.

Q: Can I use Rate-based rule to mitigate Web layer DDoS attacks?

Yes. This new rules type is designed to protect you from use cases such web-layer DDoS attacks, brute force login attempts and bad bots.

Q: What visibility features does Rate-based Rules offer?

Rate-based Rules support all the visibility features currently available on the regular Amazon WAF Rules. Additionally, they will get visibility into the IP addresses blocked as a result of the Rate-based Rule.

Q: Can I use Rate-based rule to limit access to a certain parts of my Webpage?

Yes. Here is an example. Suppose that you want to limit requests to the login page on your website. To do this, you could add the following string match condition to a rate-based rule:

• The Part of the request to filter on is “URI”.
  
• The Match Type is “Starts with”.
  
• A Value to match is “/login” (this need to be whatever identifies the login page in the URI portion of the web request)
  

Additionally, you would specify a Rate Limit of, say, 15,000 requests per 5 minutes. Adding this rate-based rule to a web ACL will limit requests to your login page per IP address without affecting the rest of your site.

Q: Can I exempt certain high-traffic source IP ranges from being blocked by my Rate-based Rule(s)?

Yes. You can do this by having a separate IP match condition that allows the request within the Rate-base Rule.

Q: How accurate is your GeoIP database?

The accuracy of the IP Address to country lookup database varies by region. Based on recent tests, our overall accuracy for the IP address to country mapping is 99.8%. 

Q: What are Managed Rules for Amazon WAF?

Managed Rules are an easy way to deploy pre-configured rules to protect your applications common threats like application vulnerabilities like OWASP. Managed Rules for Amazon WAF are managed by Amazon Web Services.

Q: Can I use Managed Rules along with my existing Amazon WAF rules?

Yes, you can use Managed Rules along with your custom Amazon WAF rules. You can add Managed Rules to your existing Amazon WAF web ACL to which you might have already added your own rules.

Q: Will Managed Rules add to my existing Amazon WAF limit on number of rules?

The number of rules inside a Managed Rule does not count towards your limit. However, each Managed Rule added to your web ACL will count as 1 rule.

Q: How can I disable a Managed Rule?

You can add a Managed Rule to a web ACL or remove it from the web ACL anytime. The Managed Rules are disabled once you disassociate a Managed Rule from any web ACLs.

Q: How can I test a Managed Rule?

Amazon WAF allows you to configure a “count” action for a Managed Rule, which counts the number of web requests that are matched by the rules inside the Managed Rule. You can look at the number of counted web requests to estimate how many of your web requests would be blocked if you enable the Managed Rule.

Q: How long does it take Amazon WAF to propagate my rules?

After an initial setup, adding or changing to rules typically takes around a minute to propagate worldwide.

Q: How can I see if my rules are working?

Amazon WAF includes three different ways to see how your website is being protected: one-minute metrics are available in CloudWatch, Sampled Web Requests are available in the Amazon WAF API or management console, and logging through Amazon Kinesis Firehose. These allow you to see which requests were blocked, allowed, or counted and what rule was matched on a given request (i.e., this web request was blocked due to an IP address condition, etc.). For more information see the Amazon WAF Developer Guide.

Q: How can I test my rules?

Amazon WAF allows you to configure a “count” action for rules, which counts the number of web requests that meet your rule conditions. You can look at the number of counted web requests to estimate how many of your web requests would be blocked or allowed if you enable the rule.

Q: How long are Real-Time Metrics and Sampled Web Requests stored?

Real-Time Metrics are stored in Amazon CloudWatch. Using Amazon CloudWatch you can configure the time period in which you want to expire events. Sampled Web Requests are stored for up to 2 hours.

Q: Can Amazon WAF inspect HTTPS traffic?

Yes. Amazon WAF helps protect applications and can inspect web requests transmitted over HTTP or HTTPS.