Skip to main content

AWS WAF (Web Application Firewall) and Application Security

Amazon’s AWS WAF web application firewall service is built specifically to protect cloud apps from a whole range of Internet threats. Learn how it works.

We all know that web applications are vulnerable to attacks, and that deploying your application from the cloud can theoretically expose it to even greater risk. To help secure their web apps, administrators will often use IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) solutions, or a Web Application Firewall. In this post we’re going to focus on WAFs and, in particular, Amazon’s AWS WAF application-level firewall service.

Because it monitors traffic at the application layer, WAF will often be the preferred choice for securing your applications. Let’s see how it works, and how Amazon’s version can take it even further.

Categories of web attacks

Before talking about AWS WAF, it makes sense to review some of the more common vulnerabilities facing web applications.

  • DDoS attacks

This is probably the most common attack of them all. Attackers overload an application by sending bulk requests to the web servers. This slows down the application and makes it unavailable for genuine requests. This can significantly hurt the value of a brand and also affect business.

  • SQL injections

An attacker can run malicious SQL queries on websites or applications using SQL based databases. If the databases aren’t secured, attackers can access confidential account and business information.

Here’s an example of SQL injection:

SELECT id FROM users WHERE username=’username’ AND password=’passwordOR 1=1’

The above statement – even using an incorrect username or password – will always return a result.

  • Cross site scripting

If your application is vulnerable to cross site scripting then the attacker can run or inject malicious scripts, generally in the form of a browser side script. If your end user is accessing a vulnerable application, his browser has no way to know that the script should not be trusted, and will execute it. These scripts can even rewrite the content of the HTML page.

These threats should certainly give us some worry. But hey, all is not lost. The web application firewall is there to help. There are many WAF tools available on the market like ModSecurity, WebCastellum, OpenWAF, and Barracuda. But now there’s also AWS WAF.

What is AWS WAF?

Now, as we all know, AWS is riding on top of the cloud computing wave. Customers are migrating all kinds of applications to AWS’s infrastructure. But the basic challenges of security remain the same: how can you protect your web applications from all the vulnerabilities we’ve discussed (along with those we didn’t mention)? Can I use the traditional WAF tools with the cloud? Will they work with my AWS infrastructure?

Yes and yes. But let’s take it one step at a time. Let’s consider a simple use case. Imagine that you have an application with some web servers, app servers, and a database, all deployed in the AWS cloud. You’d obviously like to secure your application from web attacks. How should you proceed?

The traditional approach would be to set up a firewall in front of your web servers to monitor application traffic before it hits the servers. If you’re using AWS, then most probably, it would sit between Amazon’s load balancer and the servers. You could also place it in front of the load balancer.

Design considerations

  • Choosing an appropriate WAF solution and managing its availability can really drive you crazy.
  • Setup and configuration can be very complex.
  • Making sure your WAF solution can keep up with your application as it scales can be a challenge.
  • Web traffic monitoring may not be simple.

To address these issues, Amazon has given us AWS WAF, this will protect AWS-powered web applications served by AWS services like Amazon CloudFront from attacks happening at application layer.

AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF gives you control over which traffic to allow or block to your web application by defining customizable web security rules.

How AWS WAF works

Now, instead of provisioning and maintaining your own WAF servers, you can just set up WAF from the AWS console. This will let you define your traffic filtering rules without needing to invest time ensuring proper configuration and availability.

To get started, you only need to create web ACLs. A web ACL contains at least one rule in which you specify conditions that will either block or allow incoming requests. Assuming you’re working with CloudFront, once the web ACL is ready, you can simply attach it to your application’s distribution. It’s important to understand a few key web ACL elements, like Conditions and Rules:

WAF Conditions

For your rules to work, you will need to specify the filter condition for your web ACL:
AWS WAF IP match conditions
AWS WAF SQL injection match conditions

WAF Rules

Once you are done with configuring conditions, you can create a rule and attach it to your web ACL. You can attach more than one rule to an ACL.
AWS WAF creating rulesA Web ACL, with conditions and rules, looks like this:
AWS WAF Web ACL example
AWS WAF Default action
You’re now ready to associate your new web ACL with an AWS service.


With AWS WAF, you pay only for what you use. There are no minimum fees and no upfront commitments. Your costs will depend on three major variables:

  • Number of Web ACLs: each Web ACL will cost you $5/month.
  • Number of Rules: $1.00 per rule per web ACL per month.
  • Request Count: $0.60 per million web requests.

Things to know about AWS WAF

  • Since AWS WAF is integrated with AWS CloudFront – which supports custom origins outside of AWS – it can even be used to protect websites not hosted on AWS.
  • You can configure custom error pages.
  • Real time metrics can be monitored from CloudWatch.
  • AWS WAF can inspect HTTPS traffic.

I hope this post helped give you a clear picture of AWS’s Web application firewall and its implementation.

If you’ve got any thoughts of your own, why not add them to the comments?


Written by

Vineet Badola

Working as a cloud professional for last 6 years in various organizations, I have experience in three of the most popular cloud platforms, AWS IaaS, Microsoft Azure and Pivotal Cloud Foundry PaaS platform.Having around 10 years of IT experience in various roles and I take great interest in learning and sharing my knowledge on newer technologies. Wore many hats as developer, lead, architect in cloud technologies implementation. During Leisure time I enjoy good soothing music, playing TT and sweating out in Gym. I believe sharing knowledge is my way to make this world a better place.

Related Posts

Sam Ghardashem
Sam Ghardashem
— May 15, 2019

Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway

Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.Deploying any next generation firewall in a public cloud environment is challenging, not because of the f...

Read more
  • AWS
Joe Nemer
Joe Nemer
— May 3, 2019

AWS Config Best Practices for Compliance

Use AWS Config the Right Way for Successful ComplianceIt’s well-known that AWS Config is a powerful service for monitoring all changes across your resources. As AWS Config has constantly evolved and improved over the years, it has transformed into a true powerhouse for monitoring your...

Read more
  • AWS
  • Compliance
Francesca Vigliani
— April 30, 2019

Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago

Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...

Read more
  • AWS
  • AWS Summits
Paul Hortop
Paul Hortop
— April 2, 2019

How to Monitor Your AWS Infrastructure

The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...

Read more
  • AWS
  • Monitoring
Joe Nemer
Joe Nemer
— April 1, 2019

AWS EC2 Instance Types Explained

Amazon Web Services’ resource offerings are constantly changing, and staying on top of their evolution can be a challenge. Elastic Cloud Compute (EC2) instances are one of their core resource offerings, and they form the backbone of most cloud deployments. EC2 instances provide you with...

Read more
  • AWS
  • EC2
Nitheesh Poojary
— March 26, 2019

How DNS Works – the Domain Name System (Part One)

Before migrating domains to Amazon's Route53, we should first make sure we properly understand how DNS worksWhile we'll get to AWS's Route53 Domain Name System (DNS) service in the second part of this series, I thought it would be helpful to first make sure that we properly understand...

Read more
  • AWS
Stuart Scott
— March 14, 2019

Multiple AWS Account Management using AWS Organizations

As businesses expand their footprint on AWS and utilize more services to build and deploy their applications, it becomes apparent that multiple AWS accounts are required to manage the environment and infrastructure.  A multi-account strategy is beneficial for a number of reasons as ...

Read more
  • AWS
  • Identity Access Management
Sanket Dangi
— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
  • CloudFormation
Badrinath Venkatachari
Badrinath Venkatachari
— February 1, 2019

10 Common AWS Mistakes & How to Avoid Them

Massive migration to the public cloud is changing architecture patterns, operating principles, and governance models. That means new approaches are vital to get a handle on soaring cloud spend. Because the cloud’s short-term billing cycles call for financial discipline, you must empower...

Read more
  • AWS
  • Operations
Andrew Larkin
— January 24, 2019

The 9 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS Certifications
Andrew Larkin
— January 15, 2019

2018 Was a Big Year for Content at Cloud Academy

As Head of Content at Cloud Academy I work closely with our customers and my domain leads to prioritize quarterly content plans that will achieve the best outcomes for our customers.We started 2018 with two content objectives: To show customer teams how to use Cloud Services to solv...

Read more
  • AWS
  • Azure
  • Cloud Computing
  • Google Cloud Platform
Jeremy Cook
— November 29, 2018

Amazon Elastic Inference – GPU Acceleration for Faster Inferencing

“Add GPU acceleration to any Amazon EC2 instance for faster inference at much lower cost (up to 75% savings)”So you’ve just kicked off the training phase of your multilayered deep neural network. The training phase is leveraging Amazon EC2 P3 instances to keep the training time to a...

Read more
  • AWS
  • Elastic Inference
  • re:Invent 2018