AWS WAF

AWS WAF is a web application firewall of Amazon Web Services that protects web applications from common web exploits.

Key points

Operates at the application layer (OSI layer 7), filtering HTTP/HTTPS requests using rules grouped into web ACLs — including rate-based rules and AWS Managed Rule groups — rather than inspecting network/transport-layer traffic like AWS Shield.
Protects Amazon CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, AWS AppSync GraphQL APIs, Amazon Cognito user pools, AWS App Runner services, AWS Amplify apps, Amazon Bedrock AgentCore Gateway, and AWS Verified Access instances — not Amazon Route 53, AWS Site-to-Site VPN, or AWS Transfer Family, which fall outside WAF’s supported resource types.
AWS Managed Rule groups span baseline groups (Core rule set, Admin protection, Known bad inputs) for broad coverage, use-case-specific groups (SQL database, Linux/POSIX/Windows OS, PHP, WordPress), IP reputation groups, and specialized Bot Control, Account Takeover Prevention, and Account Creation Fraud Prevention rule groups, alongside third-party managed rule groups available through AWS Marketplace.
Automates responses for SQL injection and cross-site scripting (XSS) attacks.
Uses defined web rules to protect websites or web apps from being maliciously attacked by common web attack patterns.
Works alongside AWS Shield for network/transport-layer DDoS protection — included at no additional cost with Shield Advanced for protected resources — and can be managed centrally through AWS Firewall Manager.