WAF
AWS WAF is a web application firewall: it inspects HTTP requests before they reach an application and blocks the ones that match known attack patterns. On the platform, every application load balancer in the workload accounts carries a WAF web ACL that Firewall Manager attaches for it.
What it does
A web ACL is an ordered list of rules. Each rule inspects parts of a request (path, headers, body, query string, source IP) and decides to allow, block or count it. Rules can be written by hand or taken from managed rule groups that AWS and vendors maintain and update as new attack patterns appear. A web ACL is associated with a resource that terminates HTTP: an application load balancer, a CloudFront distribution or an API Gateway stage. The default action applies to requests no rule matched. Sampled requests keep a sample of matched requests for inspection.
How BuiltForProd uses it
The platform does not write WAF rules of its own and does not create a standalone web ACL. Instead, Firewall Manager in core-security defines a baseline web ACL once, in the acme-alb-waf-baseline policy, and creates it in each plat-* account for every application load balancer. The web ACL contains four AWS managed rule groups, evaluated in order, with the default action set to allow:
| Rule group | What it catches |
|---|---|
AWSManagedRulesCommonRuleSet | Common web threats aligned with the OWASP Top 10 |
AWSManagedRulesKnownBadInputsRuleSet | Request patterns known to be malicious, such as Log4j exploitation, server-side request forgery and path traversal |
AWSManagedRulesSQLiRuleSet | SQL injection patterns in query strings, bodies and headers |
AWSManagedRulesAmazonIpReputationList | Source IPs on Amazon's threat intelligence lists |
None of the rules are overridden to count mode, so a match blocks the request. Sampled requests are enabled for the rule groups and the default action, so a blocked request can be inspected in the WAF console of the account that owns the load balancer.
In the web application blueprint, the resource behind the web ACL is the internet-facing ALB that the AWS Load Balancer Controller creates for the API from a Kubernetes Ingress. That ALB listens on HTTPS 443 only and terminates TLS with a certificate from ACM. The React frontend is served by CloudFront from a private S3 bucket; CloudFront distributions are not in the Firewall Manager policy scope, so they carry no web ACL today.
Cost follows AWS WAF pricing per web ACL, per rule group and per million requests, billed in the account that owns each load balancer. Shield Standard, which protects against volumetric DDoS attacks, is included with every load balancer and CloudFront distribution at no charge; Shield Advanced is a separate, optional subscription.
Terms you will see
| Term | Meaning |
|---|---|
| Web ACL | The list of rules associated with a load balancer or distribution. |
| Rule | One inspection with an action: allow, block or count. |
| Managed rule group | An AWS-maintained rule set referenced by name and updated automatically. |
| Default action | What happens to a request no rule matched; allow on the platform. |
| Count mode | Recording a match without blocking; not used in the baseline. |
| Sampled requests | A retained sample of matched requests for troubleshooting. |
| Association | The link between a web ACL and the resource it protects. |
Where to read more
- Web App Blueprint overview for the application behind the load balancer.
- Firewall Manager for how the web ACL reaches every account.
- Shield for the DDoS layer beneath WAF.