AWS WAF
Protect your web applications from common exploits. As a managed cloud WAF solution, AWS WAF helps you safeguard websites, APIs, and applications from bots, exploits, and other web threats at scale.
Benefits of AWS WAF
Save time with managed rules so you can focus on building applications. AWS Managed Rules provide pre-built protections against common web exploits, giving you an instant cloud-based WAF solution without the need for custom rule development. Rule groups are maintained and updated by AWS security experts to keep pace with evolving threats. This allows your team to focus on building applications while your web application firewall service handles threat mitigation automatically.
More easily monitor, block, or rate-limit common and pervasive bots. With AWS WAF Bot Control, you get a comprehensive cloud WAF solution for managing both common and advanced bots at scale. Deploy AWS WAF Common Bot protection to gain visibility and minimize or manage the excessive requests coming from unwanted known bots. Deploy AWS WAF Targeted Bots to defend against evasive bots by using fingerprinting and advanced intelligence. Apply granular controls including rate limiting, CAPTCHA challenges, and blocking. Protect your web applications and APIs from automated threats with a managed web application firewall service that adapts to evolving bot techniques.
Accelerate complex security configuration with a consolidated interface that reduces security deployment configuration complexity and steps by up to 80%. The AWS WAF console provides a single pane of glass for managing your cloud WAF solution, from rule creation to traffic monitoring. Deploy web application firewall protection across multiple AWS resources with consistent policies and centralized visibility. Reduce operational complexity while maintaining enterprise-grade WAF security across your applications.
A single, comprehensive interface combines core security functions with specialized partner protections to enhance security visibility and controls. This unified approach transforms security data into actionable insights, eliminating operational friction and accelerating risk response. By combining AWS-native and partner-provided WAF rules in one cloud-based web application firewall platform, you gain comprehensive threat coverage without managing multiple security tools. This integrated WAF solution approach simplifies compliance and strengthens your overall security posture.
Preconfigured protection packs leverage AWS's security expertise to deliver instant protection templates for specific industries and workload types like APIs, Linux and Windows operating systems, and SQL databases. These templates are continuously optimized to ensure up-to-date web application firewall service coverage without requiring deep deployment expertise. Gain continuous security recommendations to strengthen overall security posture. This approach makes enterprise-grade cloud WAF protection accessible to teams of any size, reducing the barrier to deploying a comprehensive WAF solution.
Why AWS WAF?
AWS WAF is a managed cloud web application firewall service that gives you control over how traffic reaches your applications. Create security rules that block common attack patterns such known vulnerabilities while simultaneously managing bot traffic with advanced controls. With native integration across AWS services like Amazon CloudFront, Amazon API Gateway, and Application Load Balancer, AWS WAF delivers scalable, enterprise-grade WAF solutions that protect your web applications and APIs from evolving threats. This cloud-based WAF solution scales automatically with your traffic, providing consistent web application firewall protection without capacity planning.
AWS WAF Use Cases
Filter web traffic
Create rules to filter web requests based on conditions such as IP addresses, HTTP headers and body, or custom URIs. With AWS WAF, you can build custom filtering logic that inspects every aspect of incoming web requests, providing precise control over which traffic reaches your applications. This cloud WAF solution supports complex rule combinations, enabling you to implement layered web application firewall protection that adapts to your specific security requirements.
Prevent account takeover fraud
Monitor your application's login page for unauthorized access to user accounts using compromised credentials. With AWS WAF Account Takeover Prevention, you get cloud-based web application firewall protection specifically designed to safeguard authentication workflows. This WAF service capability analyzes login requests for indicators of credential stuffing and brute-force attacks, automatically blocking suspicious attempts while allowing legitimate users through.
Automatic layer 7 DDoS protection
Designed to continuously monitor and automatically mitigate application layer (layer 7) Distributed Denial of Service (DDoS) events within seconds. This cloud-based WAF solution uses rate-based rules and intelligent traffic analysis to identify and block DDoS attack traffic while allowing legitimate requests through. AWS WAF's automated Layer 7 DDoS protection works alongside AWS Shield to provide a complete web application firewall defense strategy.
Rapid security implementation
Launch new applications with confidence using the streamlined guided onboarding setup with a single-page interface to activate preconfigured security defaults tailored to your needs. AWS WAF's one-click deployment experience reduces the complexity of implementing web application firewall services, enabling teams to protect new applications without deep security expertise. Get cloud-based WAF protection running quickly with best-practice defaults that you can customize as your needs evolve.
Protect and Optimize All Ingress Internet Traffic
Extend cloud web application firewall protection to all internet traffic your APIs and microservices with native AWS service integrations while optimizing performance and operating cost by deploying AWS WAF on Amazon’s Content Delivery Network (CDN), Amazon CloudFront. Deploy your APIs and Microservices behind AWS WAF and Amazon CloudFront to protect API traffic. Seamless integration with other AWS Services helps protect and optimize your entire application surface—from traditional web applications to modern API-driven architectures—with a single, scalable WAF solution.
Additional AWS WAF use cases
Strengthen security posture and collect payment from AI bots accessing your content.
Strengthen security posture
Through expert-curated rule packs, consolidated visibility, and ongoing recommendations, you get immediate protection to optimize your security posture.
Collect payment from AI bots accessing your content
Monetize AI bot and agents accessing your content and APIs. Offers configurable per-content pricing, differentiated rates by bot identity, and payment verification at the edge in a single place to analyze traffic and generate new revenue streams.
AWS WAF FAQs
Frequently asked questions
What does a web application firewall (WAF) do?
A web application firewall (WAF) monitors, filters, and blocks HTTP/HTTPS traffic to and from web applications. It protects against common exploits such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. A WAF operates at Layer 7 of the OSI model, inspecting application-level traffic to identify and mitigate threats before they reach your servers.
How does AWS WAF work?
AWS WAF lets you create security rules that control bot traffic and block common attack patterns. You define rules in web access control lists (web ACLs) and associate them with your AWS resources such as Amazon CloudFront distributions, Application Load Balancers, or Amazon API Gateway APIs. AWS WAF inspects incoming requests against your rules in real time and takes the configured action—allow, block, or count.
What is the difference between a WAF and a traditional firewall?
A traditional firewall operates at the network layer (Layers 3–4), filtering traffic based on IP addresses, ports, and protocols. A web application firewall (WAF) operates at the application layer (Layer 7), inspecting the content of HTTP/HTTPS requests to detect application-specific attacks. While traditional firewalls protect network infrastructure, a WAF specifically protects web applications and APIs from exploits like SQL injection and cross-site scripting.
What's the difference in cost between Common and Targeted Bot Control?
Common Bots cost $10 per month per Web ACL and $1 per 1 million requests. Targeted Bots cost $10 per month per Web ACL and $10 per month per 1 million requests. Common Bots is included in the Targeted Bots pricing. Only requests that reach Common and Targeted Bots will be charged a per request cost. This is important because on average, 50% of total requests to AWS WAF are filtered out before the traffic passes through to Common Bots and on average 20% of overall WAF requests pass through to Targeted Bots when other AMRs included with the WAF per request fee are configured above Common and Targeted Bots.
What types of attacks does AWS WAF protect against?
AWS WAF protects against a wide range of web application threats, including SQL injection, cross-site scripting (XSS), HTTP flood attacks, and malicious bot activity. With AWS Managed Rules, you get pre-configured rule groups that address common vulnerabilities such as the OWASP Top 10. AWS WAF Bot Control provides advanced bot management to detect and mitigate automated threats.
Can AWS WAF protect APIs and microservices?
Yes, AWS WAF can protect APIs and microservices by integrating with Amazon API Gateway and AWS AppSync. You can apply web ACL rules to inspect and filter API traffic, blocking malicious requests before they reach your backend services. This makes AWS WAF an effective cloud web application firewall solution for modern API-driven architectures.
What AWS services does AWS WAF integrate with?
AWS WAF integrates natively with Amazon CloudFront, Application Load Balancer, Amazon API Gateway, AWS AppSync, and Amazon Cognito. This allows you to deploy web application firewall protection at multiple points in your architecture. You can also use AWS Firewall Manager to centrally manage WAF rules across multiple AWS accounts and resources.
Who should use a web application firewall solution?
Any organization running web applications or APIs that are exposed to the internet should consider a web application firewall solution. AWS WAF is particularly well-suited for enterprises running workloads on AWS that need scalable, cloud-native protection against web exploits and bot attacks. It is ideal for teams that want managed security rules without the overhead of maintaining dedicated security appliances.
Are pricing programs available for AWS WAF, AWS WAF Common and Targeted Bots, and AWS WAF Fraud Protection?
It is possible depending on the use case and volume. Contact your AWS Sales Team for details.
Will Common Bot Control block good bots like search engine crawlers?
Only if put in block mode. The AWS WAF Common Bot AWS Managed Rule (AMR) provides visibility into your overall bot traffic. Customers can choose which bots they would like to allow, block, or rate-limit depending on their needs.
What if I deploy an AWS Managed Rule (AMR) and I have a false positive?
AMRs have many sub-rules within the AMR that can be managed separately by changing the response to count while the other sub-rules stay in block mode. AWS WAF Labeling allows for monitoring of sub-rules so that further custom rules can be deployed further on down the rule stack to address false positives.
Can I just use AWS WAF Common Bot AWS Managed Rule (AMR) and forgo the use of the AWS WAF Targeted Bot AMR?
If your use case is to manage known bots, the AWS WAF Common Bot AMR will be sufficient. If your use case is to defend against evasive bots that do not identify themselves, the AWS WAF Targeted Bot AMR will be needed.
What does the AWS WAF Targeted Bot AWS Managed Rule (AMR) do that the AWS WAF Common Bot AMR does not?
The AWS WAF Targeted Bot AMR applies behavior based detection by using browser fingerprinting, environmental interrogation, proof of work, and detection of coordinated activities with machine learning. The AWS WAF Common Bot AMR identifies bots that identify themselves.