Waf

AWS WAF with rate limiting, IP reputation, OWASP core rules and SQL injection protection in one line. Starts in count mode so nothing breaks.

Security · anvil:aws:Waf

Rolling it out: count, then block

A new WAF starts in count mode: every rule match is logged, but nothing is blocked, so false positives can't break live traffic. Leave it for a few days, check the logs for legitimate requests being matched (fix those with ruleOverrides), then set mode: 'block'. Switching mode updates the WAF in place — no site redeploy.

A WAF in count mode protects nothing. Only the IP block list is enforced. Don't forget to switch to mode: 'block'.

Seeing what it blocks

CloudFront WAFs live in us-east-1 / Global, whatever region your stack is in.

  • Quick view: AWS Console → WAF & Shield → region Global (CloudFront) → your web ACL (the name output). Traffic overview charts blocks per rule; Sampled requests lists individual requests with the rule that matched.
  • Full logs: CloudWatch → Logs Insights in us-east-1, log group = the logGroupName output. Blocked and counted requests are logged; authorization, cookie and x-origin-secret headers are redacted.
fields @timestamp, action, terminatingRuleId, httpRequest.clientIp, httpRequest.uri
| filter action = "BLOCK"
| sort @timestamp desc

In count mode, matches show action = "ALLOW" with the matched rule under nonTerminatingMatchingRules.

Behind Cloudflare or another proxy

Behind a proxy, the WAF sees the proxy's IPs instead of visitors'. Set clientIpHeader (e.g. 'CF-Connecting-IP') so the rate limit, IP lists and country blocking use the real visitor IP. AWS's IP-reputation and anonymous-IP groups can't read that header, so they switch off by default when it's set.

Only set clientIpHeader when every request goes through the proxy — pair it with originProtection: true on the site. Otherwise a client can send the header itself and pick its own IP to dodge rate limits and blocks.

Cloudflare includes its own WAF on every plan, so behind Cloudflare an AWS WAF is optional — use originProtection on the site to stop CloudFront being reached around it.