Waf
AWS WAF with rate limiting, IP reputation, OWASP core rules and SQL injection protection in one line. Starts in count mode so nothing breaks.
What it blocks by default
new anvil.aws.Waf('edge') creates these rules, evaluated in order — cheap
IP checks first, expensive body inspection last. Requests that match nothing are allowed.
| Rule | Default | Stops |
|---|---|---|
ipAllowList | only if set | Always allows these IPs, skipping every other rule |
ipBlockList | only if set | Always blocks these IPs — in count mode too |
blockCountries | only if set | Traffic from the listed countries |
| Rate limit | on — 2,000 requests per client per 5 min | Floods and brute force from a single IP |
| IP reputation | on | IPs on Amazon's threat-intelligence lists |
| Known bad inputs | on | Log4Shell, Spring4Shell, Java deserialisation, React RCE and other known exploits |
| Core rule set | on | OWASP Top 10: XSS, path traversal, remote file inclusion, cloud metadata SSRF, scanners |
| SQL injection | on | SQL injection in query strings, bodies, cookies and paths |
| Anonymous IPs | off | VPNs, Tor, hosting providers — suits B2B apps |
| Admin protection | off | Requests to admin-looking paths |
The core rule set's "body over 8 KB" rule (SizeRestrictions_BODY) only counts by
default — blocking it would break forms, JSON APIs and uploads. Restore it with ruleOverrides: { SizeRestrictions_BODY: 'block' }.
What it doesn't cover
- Request bodies beyond the first 16 KB aren't inspected (an AWS WAF limit for CloudFront). An attack placed after 16 KB of padding gets through — keep validating input in your app.
- Distributed and slow attacks: the rate limit is per IP, so many IPs or a slow
rate stay under it. Lower
rateLimitto suit your traffic. - Bots and application-layer DDoS: AWS's paid Bot Control and Anti-DDoS groups aren't included.
- Your app's own bugs: broken access control, auth flaws and business logic. A WAF catches known attack patterns, not logic errors.
- HttpApi: AWS WAF can't attach to API Gateway HTTP APIs. Verify webhook signatures and use authorizers there.
Verified on AWS
Tested against a deployed site in block mode:
| Test | Result |
|---|---|
| XSS, SQL injection (query and body), path traversal, Log4Shell, metadata SSRF, scanner and missing user agents, sensitive file extensions | 9/9 blocked |
Evasions: double URL-encoding, mixed case, XSS without <script>, SQL comment obfuscation, attacks in cookies and on static-asset paths, spoofed X-Forwarded-For | 7/7 blocked |
| Legitimate traffic: pages, form posts, JSON, 20 KB bodies | All allowed |
| Rate limit (lowered to 100 / min for the test) | Blocking started after ~28 s; 801 of 972 requests blocked |
| Calling the site's server directly, around CloudFront and the WAF | 8/8 refused (403) |
| SQL injection hidden after 17 KB of body padding | Not blocked — the 16 KB inspection limit above |