# AWS WAF

> A filter in front of your website that reads each request and blocks the bad ones.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-waf/
- In Spanish: [AWS WAF](https://tidbit.legios.com.ar/es/aws-waf/)

A regular firewall looks at addresses and ports: who is connecting, and to which door. A **web application firewall** (WAF) looks inside the web request itself: the URL, the headers, the form fields. **AWS WAF** is that filter on AWS. You put it in front of Amazon CloudFront, a load balancer or Amazon API Gateway, and every request is checked against your rules before it reaches your app.

The rules live in a **web ACL** and can be as simple or as sharp as you need. Block requests that try **SQL injection** (sneaking database commands into a search box) or cross-site scripting. Limit any single IP address to a certain number of requests per few minutes, which stops crude scrapers and password-guessing bots. Allow only some countries, or block known bad addresses. Each rule says allow, block, or just count, so you can test a rule before enforcing it.

You do not have to write everything yourself: AWS and security vendors publish **managed rule groups** that cover common attacks and are kept up to date. WAF does not fix bugs in your code, but it buys time, catching the predictable attacks at the door while the real fix is on its way.

## An analogy

A bouncer who does not just check the guest list but also looks inside the bags. Ordinary visitors walk in; anyone carrying something suspicious, or trying to enter fifty times in a minute, stays outside.

## Keep in mind

- Inspects web requests (layer 7), not just addresses and ports.
- Sits in front of CloudFront, load balancers and API Gateway.
- Rules can block injection attacks, cap requests per IP, or filter by country.
- Managed rule groups give ready-made, maintained protection.

## Go deeper

- [What is AWS WAF? (official docs)](https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html)
- [AWS WAF](https://aws.amazon.com/waf/)
- [Web application firewall on Wikipedia](https://en.wikipedia.org/wiki/Web_application_firewall)

## Related terms

- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [Port](https://tidbit.legios.com.ar/port/): The numbered door on a computer that says which program a connection is for.
- [URL](https://tidbit.legios.com.ar/url/): The full address of something on the web: protocol, site and path.
- [Amazon CloudFront](https://tidbit.legios.com.ar/amazon-cloudfront/): AWS's CDN: copies of your content kept close to users all over the world.
- [Load balancer](https://tidbit.legios.com.ar/load-balancer/): The traffic cop that spreads incoming requests across many servers.
- [Amazon API Gateway](https://tidbit.legios.com.ar/amazon-api-gateway/): The front door of your API: it receives requests and passes them to your code.
- [SQL injection](https://tidbit.legios.com.ar/sql-injection/): Typing text into a form that the database mistakes for its own instructions.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.