AWS WAF
Web firewall
Filters malicious HTTP requests (SQL injection, XSS, bots, bad IPs) before they reach CloudFront, ALB, API Gateway.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike a gate guard checking people against a blacklist and suspicious signs.
Where does WAF fit?
WAFWAF calls
A real example, step by step
- A bot is trying thousands of passwords per minute against your login page.
- You create a web ACL in AWS WAF and attach it to the CloudFront distribution in front of the site.
- You turn on AWS managed rules that block SQL injection and XSS, without writing rules yourself.
- A rate-based rule blocks any IP that sends more than 300 requests to /login within 5 minutes.
- The bot is stopped at the edge; bad requests never reach your servers.
When to use it
✓ Use it when
Public web applications.
✗ Avoid it when
Network-layer DDoS protection → Shield; filtering traffic inside a VPC → Network Firewall.
Common uses
- Block SQL injection, XSS with managed rules
- Rate limiting against brute-force and bots
- Block by IP or country
WAF, VPC or CloudFront?
| WAF |  VPC |  CloudFront | |
|---|---|---|---|
| Protects at | Application layer (HTTP): SQL injection, XSS, bots | Network: IPs, ports (security groups, NACLs) | Content delivery; Shield Standard blocks DDoS by default |
| Attaches to | CloudFront, ALB, API Gateway, AppSync, Cognito… | Resources inside the VPC | Sits in front of the website |
| Understands request content | Yes (path, headers, body) | No | Partly (caching by path, headers) |
| Billing | Per web ACL, rule and request | Security groups are free | Per data transferred |
What does it cost?
- Pricing model: $5/web ACL/month + $1/rule/month + $0.60/1 million requests. Advanced rule sets (Bot Control, Fraud Control) cost extra.
- Free tier: None.
Bot Control/Fraud Control per-request charges are fairly expensive; creating a separate web ACL per environment.
Block SQL injection or XSS, rate-limit a single IP, block by country → WAF. Network-layer DDoS protection → Shield (Advanced if you need response support and cost protection). WAF can't be attached to EC2 or an NLB.
Try real exam questions
1A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture. What should a solutions architect do next to protect against threats?
- AUse Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge (Amazon CloudWatch Events) to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.
- BUse AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge (Amazon CloudWatch Events) to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
- CUse Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
- DUse Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
Show answer
Correct answer: A
GuardDuty detects suspicious behavior; EventBridge catches its findings and invokes Lambda to update the WAF rules automatically. Inspector scans software vulnerabilities and Macie finds sensitive data; neither is a threat detector.
2A company runs a web application on Amazon EC2 instances in an Auto Scaling group that has a target group. The company designed the application to work with session affinity (sticky sessions) for a better user experience. The application must be available publicly over the internet as an endpoint. A WAF must be applied to the endpoint for additional security. Session affinity (sticky sessions) must be configured on the endpoint. Which combination of steps will meet these requirements? (Choose two.)
- ACreate a public Network Load Balancer. Specify the application target group.
- BCreate a Gateway Load Balancer. Specify the application target group.
- CCreate a public Application Load Balancer. Specify the application target group.
- DCreate a second target group. Add Elastic IP addresses to the EC2 instances.
- ECreate a web ACL in AWS WAF. Associate the web ACL with the endpoint.
Show answer
Correct answer: C, E
A public Application Load Balancer supports sticky sessions and can have an AWS WAF web ACL attached. NLBs and Gateway Load Balancers can't have WAF attached.
Frequently asked questions
What is the difference between WAF and Shield?
WAF filters HTTP requests at the application layer: blocking SQL injection, XSS and bots, and rate-limiting by IP. Shield protects against DDoS; Shield Standard is on for free in every account, while Shield Advanced is paid and adds support from the AWS DDoS response team.
Where can I attach WAF?
To CloudFront, Application Load Balancers, API Gateway REST APIs, AppSync, Cognito user pools, App Runner and Verified Access. WAF can't be attached directly to EC2 or an NLB.
How is WAF priced?
By the number of web ACLs, the rules in each ACL and the requests inspected. Managed rule groups from AWS Marketplace and features such as Bot Control or fraud prevention cost extra.
What do AWS exams ask about WAF?
Blocking SQL injection and XSS with managed rules, rate-based rules against floods from a single IP, geo blocking, attaching WAF to the right resource, and telling it apart from Shield, Network Firewall and security groups.