Hello and welcome to this short lecture where I shall explain the limitations of the WAF service. Most AWS services have default service limits that can vary over time and from region to region. For AWS WAF, some of the default service limits can be increased by logging a request via the AWS Support Center, these conditions are as follows. You can have 100 conditions of each type, such as Geo Match or size constraints, however Regex is the exception to this rule where only 10 Regex conditions are allowed but this limit is possible to increase. You are able to have 100 rules and 50 Web ACLs per AWS account. You are limited to 5 rate-based-rules per account. Finally you can have 10,000 requests per second when using WAF within your application load balancer. For more limitations regarding specific WAF entries and to get the latest limitations please visit the following link. For small to medium solutions these limits will more than likely be more than adequate, especially as you can assign the same Web ACL to different CloudFront distributions without affecting these limits.

If however you are a large enterprise and find you are reaching these limitations then do be aware you can request an increase. Unfortunately not all the limits can be increased, and the following are static limitations that currently cannot be changed. These limitations also make a good reasons to implement a reactive rule policy to ensure you are only configuring rules and conditions that need to be configured. That brings me to the end of this lecture. Although it was short, it is important for you to understand the AWS WAF service limitations. Knowing these limitations can influence how you architect and design your Web ACLs.