Skip to main content

AWS WAF (Web Application Firewall) and Application Security

Amazon’s AWS WAF web application firewall service is built specifically to protect cloud apps from a whole range of Internet threats. Learn how it works.

We all know that web applications are vulnerable to attacks, and that deploying your application from the cloud can theoretically expose it to even greater risk. To help secure their web apps, administrators will often use IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) solutions, or a Web Application Firewall. In this post we’re going to focus on WAFs and, in particular, Amazon’s AWS WAF application-level firewall service.

Because it monitors traffic at the application layer, WAF will often be the preferred choice for securing your applications. Let’s see how it works, and how Amazon’s version can take it even further.

Categories of web attacks

Before talking about AWS WAF, it makes sense to review some of the more common vulnerabilities facing web applications.

  • DDoS attacks

This is probably the most common attack of them all. Attackers overload an application by sending bulk requests to the web servers. This slows down the application and makes it unavailable for genuine requests. This can significantly hurt the value of a brand and also affect business.

  • SQL injections

An attacker can run malicious SQL queries on websites or applications using SQL based databases. If the databases aren’t secured, attackers can access confidential account and business information.

Here’s an example of SQL injection:

SELECT id FROM users WHERE username=’username’ AND password=’passwordOR 1=1’

The above statement – even using an incorrect username or password – will always return a result.

  • Cross site scripting

If your application is vulnerable to cross site scripting then the attacker can run or inject malicious scripts, generally in the form of a browser side script. If your end user is accessing a vulnerable application, his browser has no way to know that the script should not be trusted, and will execute it. These scripts can even rewrite the content of the HTML page.

These threats should certainly give us some worry. But hey, all is not lost. The web application firewall is there to help. There are many WAF tools available on the market like ModSecurity, WebCastellum, OpenWAF, and Barracuda. But now there’s also AWS WAF.

What is AWS WAF?

Now, as we all know, AWS is riding on top of the cloud computing wave. Customers are migrating all kinds of applications to AWS’s infrastructure. But the basic challenges of security remain the same: how can you protect your web applications from all the vulnerabilities we’ve discussed (along with those we didn’t mention)? Can I use the traditional WAF tools with the cloud? Will they work with my AWS infrastructure?

Yes and yes. But let’s take it one step at a time. Let’s consider a simple use case. Imagine that you have an application with some web servers, app servers, and a database, all deployed in the AWS cloud. You’d obviously like to secure your application from web attacks. How should you proceed?

The traditional approach would be to set up a firewall in front of your web servers to monitor application traffic before it hits the servers. If you’re using AWS, then most probably, it would sit between Amazon’s load balancer and the servers. You could also place it in front of the load balancer.

Design considerations

  • Choosing an appropriate WAF solution and managing its availability can really drive you crazy.
  • Setup and configuration can be very complex.
  • Making sure your WAF solution can keep up with your application as it scales can be a challenge.
  • Web traffic monitoring may not be simple.

To address these issues, Amazon has given us AWS WAF, this will protect AWS-powered web applications served by AWS services like Amazon CloudFront from attacks happening at application layer.

AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF gives you control over which traffic to allow or block to your web application by defining customizable web security rules.

How AWS WAF works

Now, instead of provisioning and maintaining your own WAF servers, you can just set up WAF from the AWS console. This will let you define your traffic filtering rules without needing to invest time ensuring proper configuration and availability.

To get started, you only need to create web ACLs. A web ACL contains at least one rule in which you specify conditions that will either block or allow incoming requests. Assuming you’re working with CloudFront, once the web ACL is ready, you can simply attach it to your application’s distribution. It’s important to understand a few key web ACL elements, like Conditions and Rules:

WAF Conditions

For your rules to work, you will need to specify the filter condition for your web ACL:
AWS WAF IP match conditions
AWS WAF SQL injection match conditions

WAF Rules

Once you are done with configuring conditions, you can create a rule and attach it to your web ACL. You can attach more than one rule to an ACL.
AWS WAF creating rulesA Web ACL, with conditions and rules, looks like this:
AWS WAF Web ACL example
AWS WAF Default action
You’re now ready to associate your new web ACL with an AWS service.


With AWS WAF, you pay only for what you use. There are no minimum fees and no upfront commitments. Your costs will depend on three major variables:

  • Number of Web ACLs: each Web ACL will cost you $5/month.
  • Number of Rules: $1.00 per rule per web ACL per month.
  • Request Count: $0.60 per million web requests.

Things to know about AWS WAF

  • Since AWS WAF is integrated with AWS CloudFront – which supports custom origins outside of AWS – it can even be used to protect websites not hosted on AWS.
  • You can configure custom error pages.
  • Real time metrics can be monitored from CloudWatch.
  • AWS WAF can inspect HTTPS traffic.

I hope this post helped give you a clear picture of AWS’s Web application firewall and its implementation.

If you’ve got any thoughts of your own, why not add them to the comments?

Written by

Vineet Badola

Working as a cloud professional for last 6 years in various organizations, I have experience in three of the most popular cloud platforms, AWS IaaS, Microsoft Azure and Pivotal Cloud Foundry PaaS platform.Having around 10 years of IT experience in various roles and I take great interest in learning and sharing my knowledge on newer technologies. Wore many hats as developer, lead, architect in cloud technologies implementation. During Leisure time I enjoy good soothing music, playing TT and sweating out in Gym. I believe sharing knowledge is my way to make this world a better place.

Related Posts

Sanket Dangi
— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
Andrew Larkin
— January 24, 2019

The 9 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS certifications
Andrew Larkin
— November 28, 2018

Two New EC2 Instance Types Announced at AWS re:Invent 2018 – Monday Night Live

The announcements at re:Invent just keep on coming! Let’s look at what benefits these two new EC2 instance types offer and how these two new instances could be of benefit to you. If you're not too familiar with Amazon EC2, you might want to familiarize yourself by creating your first Am...

Read more
  • AWS
  • EC2
  • re:Invent 2018
Guy Hummel
— November 21, 2018

Google Cloud Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2018, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the first time. In t...

Read more
  • AWS
  • Azure
  • Google Cloud
Khash Nakhostin
Khash Nakhostin
— November 13, 2018

Understanding AWS VPC Egress Filtering Methods

In order to understand AWS VPC egress filtering methods, you first need to understand that security on AWS is governed by a shared responsibility model where both vendor and subscriber have various operational responsibilities. AWS assumes responsibility for the underlying infrastructur...

Read more
  • Aviatrix
  • AWS
  • VPC
Jeremy Cook
— November 10, 2018

S3 FTP: Build a Reliable and Inexpensive FTP Server Using Amazon’s S3

Is it possible to create an S3 FTP file backup/transfer solution, minimizing associated file storage and capacity planning administration headache?FTP (File Transfer Protocol) is a fast and convenient way to transfer large files over the Internet. You might, at some point, have conf...

Read more
  • Amazon S3
  • AWS
Guy Hummel
— October 18, 2018

Microservices Architecture: Advantages and Drawbacks

Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs).Microservices have become increasingly popular over the past few years. The modular architectural style,...

Read more
  • AWS
  • Microservices
Stuart Scott
— October 2, 2018

What Are Best Practices for Tagging AWS Resources?

There are many use cases for tags, but what are the best practices for tagging AWS resources? In order for your organization to effectively manage resources (and your monthly AWS bill), you need to implement and adopt a thoughtful tagging strategy that makes sense for your business. The...

Read more
  • AWS
  • cost optimization
Stuart Scott
— September 26, 2018

How to Optimize Amazon S3 Performance

Amazon S3 is the most common storage options for many organizations, being object storage it is used for a wide variety of data types, from the smallest objects to huge datasets. All in all, Amazon S3 is a great service to store a wide scope of data types in a highly available and resil...

Read more
  • Amazon S3
  • AWS
Cloud Academy Team
— September 18, 2018

How to Optimize Cloud Costs with Spot Instances: New on Cloud Academy

One of the main promises of cloud computing is access to nearly endless capacity. However, it doesn’t come cheap. With the introduction of Spot Instances for Amazon Web Services’ Elastic Compute Cloud (AWS EC2) in 2009, spot instances have been a way for major cloud providers to sell sp...

Read more
  • AWS
  • Azure
  • Google Cloud
  • SpotInst
Guy Hummel and Jeremy Cook
— August 23, 2018

What are the Benefits of Machine Learning in the Cloud?

A Comparison of Machine Learning Services on AWS, Azure, and Google CloudArtificial intelligence and machine learning are steadily making their way into enterprise applications in areas such as customer support, fraud detection, and business intelligence. There is every reason to beli...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Machine Learning
Stuart Scott
— August 17, 2018

How to Use AWS CLI

The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services.So you’ve been using AWS for awhile and finally feel comfortable clicking your way through all the services....

Read more
  • AWS