In addition, you can create rules that can block or rate-limit traffic from specific user-agents, from specific IP addresses, or that contain particular request headers. See the AWS WAF Developer Guide for examples. Which types of attacks can AWS WAF help me to stop?ĪWS WAF helps protects your website from common attack techniques like SQL injection and Cross-Site Scripting (XSS). Yes, AWS WAF is integrated with Amazon CloudFront, which supports custom origins outside of AWS. When you use AWS WAF on regional services, such as Application Load Balancer, Amazon API Gateway, and AWS AppSync, your rules run in region and can be used to protect internet-facing resources as well as internal resources.Ĭan I use AWS WAF to protect web sites not hosted in AWS? Blocked requests are stopped before they reach your web servers. This means security doesn’t come at the expense of performance. When you use AWS WAF on Amazon CloudFront, your rules run in all AWS Edge Locations, located around the world close to your end users.

How does AWS WAF protect my web site or application?ĪWS WAF is tightly integrated with Amazon CloudFront, the Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync – services that AWS customers commonly use to deliver content for their websites and applications. Once a request meets a condition defined in your rules, AWS WAF instructs the underlying service to either block or allow the request based on the action you define. These conditions include IP addresses, HTTP headers, HTTP body, URI strings, SQL injection and cross-site scripting.Īs the underlying service receives requests for your web sites, it forwards those requests to AWS WAF for inspection against your rules.

AWS WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define.

What is waf