AWS WAF for Beginners

What Is AWS WAF?

AWS WAF means Web Application Firewall. Think of it as a door guard for your website.

Every time someone opens a page or calls your API, a request arrives. WAF can look at that request and decide:

• Allow — let it in.
• Block — stop it.
• Count — note it, but still let it in (safe for learning).

You write these choices as rules. A group of rules is called a web ACL (say it like “web A-C-L”). Then you attach that web ACL to the service that faces the internet—often CloudFront or an Application Load Balancer.

In Simple Words

What problem does it solve?

Your site is public. Anyone on the internet can send requests. Most requests are fine. Some try to break your app (for example by sending strange text in a form). WAF helps catch many of those bad patterns early.

Is WAF the same as a password?

No. Login and passwords are for who the user is. WAF is about what the request looks like—IP address, URL, headers, and body text.

When should a beginner use it?

After your site already loads with HTTPS. Learn CloudFront or an ALB first. Then add WAF as an extra safety layer.

A tiny traffic picture

Visitor → WAF check → CloudFront or load balancer → your app. If WAF blocks the request, your app never has to handle it.

Words You Will See

Do not memorize these. Just come back when the console shows a new word.

What You Need First

Before you click Create, have these ready:

Step-by-Step

Four small steps. After each step, your site should still open in the browser.

Step 1 — Create an Empty Web ACL

This is only the empty rule book. Nothing is blocked yet.

1. Sign in to the AWS console.
2. Search for WAF & Shield and open it.
3. Choose Web ACLs, then Create web ACL.
4. Choose where it will be used:
   • CloudFront distributions if users hit CloudFront first.
   • Regional resources if users hit an ALB (or similar) first.
5. Give it a clear name, like my-site-waf.
6. For a normal public website, set the default action to Allow.
7. Continue through the wizard. You can add rules in the next step.

How It Works

1. You created the rule book, not the lock yet.
2. CloudFront and ALB need different scopes. Pick the one that matches your door.
3. Default Allow means: if no rule says otherwise, the visitor can still enter.
4. Your live site is unchanged until you associate this ACL in Step 3.

Step 2 — Add Ready-Made Rules (Count Mode)

AWS already wrote good starter rules. Turn them on gently.

1. In your web ACL, open Rules.
2. Choose Add rules → Add managed rule groups.
3. Enable a common pack (often named like Core rule set / common rule set).
4. Set the action to Count while you learn.
5. Save the rules.

How It Works

1. Managed rules are AWS’s starter checklist for common web attacks.
2. Count is practice mode: AWS notes matches, users still get the page.
3. You are not blocking anyone yet, so this step is low risk.
4. Later you can flip Count to Block for rules you trust.

Do not jump to Block on day one.

Some normal forms and admin pages can look “suspicious” to strict rules. Count first.

Step 3 — Attach the Web ACL to Your Door

Now connect the rule book to CloudFront or your load balancer.

1. Open your web ACL.
2. Find Associated AWS resources (wording can vary slightly).
3. Choose Add AWS resources.
4. Select your CloudFront distribution or your ALB.
5. Save, wait a minute or two, then open your site in a browser.

How It Works

1. Association means: check every request at this door.
2. CloudFront attachment filters traffic near visitors (the edge).
3. ALB attachment filters traffic when visitors talk to the load balancer directly.
4. If the homepage still loads, the attach step worked and Count rules are not blocking you.

Step 4 — Watch the Matches, Then Tighten

Learn what WAF sees before you change user experience.

1. Browse your site like a normal user for a while.
2. In WAF, open the overview or sampled requests for your web ACL.
3. Look for rules that fire on normal pages. Those may need softer settings later.
4. When a rule looks trustworthy, change that rule from Count to Block.
5. Test the site again after each change.

How It Works

1. Sampled requests are examples of traffic that matched a rule.
2. Your goal is fewer surprises, not maximum Block on day one.
3. Change one thing at a time so you know what broke the site if something goes wrong.
4. Keep a way back: you can switch a rule back to Count or remove the association.

Common Beginner Mistakes

Key Takeaways