AWS WAF

AWS WAF is a cloud-based web application firewall provided by AWS, that helps protect web applications or APIs against common web exploits that could affect application availability, compromise security, or consume excessive resources. It can be deployed on Amazon CloudFront as part of the CDN solution, the Application Load Balancer that fronts web servers or origin servers running on EC2, or Amazon API Gateway for APIs.

AWS WAF allows you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that exclude specific traffic patterns that you define, so you can control how traffic reaches your application.

AWS WAF Features

Agile Protection Against
Web Attacks

AWS WAF supports hundreds of rules that can inspect any part of the web request with minimal latency impact to incoming traffic. AWS WAF protects web applications from attacks by filtering traffic based on rules that you create. For example, you can filter any part of the web request, such as IP addresses, HTTP headers, HTTP body, or URI strings. This allows you to block common attack patterns, such as SQL injection or cross-site scripting.
Ease of Deployment & Maintenance

AWS WAF is easy to deploy and protect applications deployed on either Amazon CloudFront as part of your CDN solution, the Application Load Balancer that fronts all your origin servers, or Amazon API Gateway for your APIs. There is no additional software to deploy, DNS configuration, SSL/TLS certificate to manage, or need for a reverse proxy setup. With AWS Firewall Manager integration, you can centrally define and manage your rules, and reuse them across all the web applications that you need to protect.
Self-service

Every feature in AWS WAF can be configured, which allows your DevOps team to define application-specific rules that increase web security as they develop applications. This lets you put web security at multiple points in the development process chain, from the hands of the developer initially writing code, to the DevOps engineer deploying software, to the security administrators enforcing a set of rules across the organization.

Challenges of AWS WAF

Expert knowledge requirement for rule creation

AWS WAF is self-service and you have to create and tune rules yourself. However, creating better rules requires expert knowledge.
Tuning of rules that do not reduce the defense performance

After creating rules, it is necessary to check the access log regularly and fine-tune the rules.
However, you must be careful not to degrade your defense performance when tuning the rules.
Visualization by detection notification & reporting

If a threat is detected by AWS WAF, there is no notification or reporting function, so there is a disadvantage that you do not know until you check the management screen.
Creation of secure rules to correspond to vulnerabilities

The most important thing when creating rules is to have secure rules that address vulnerabilities while preventing false positives.
Researching new vulnerabilities

As AWS WAF is a self-service, users need to handle new vulnerabilities themselves.