AWS WAF Reviews

What I like most about AWS WAF is that it helps protect web applications from common threats without requiring dedicated security appliances or complicated infrastructure. Features such as managed rule sets, custom rules, IP filtering, and bot protection make it easier to secure applications while still maintaining performance.

Its integration with CloudFront, Application Load Balancers, and API Gateway is especially valuable because it lets me apply security controls consistently across multiple application entry points.

False positives can sometimes happen, especially when aggressive security rules end up blocking legitimate traffic. To maintain a good balance between strong security and a smooth user experience, ongoing rule tuning and regular monitoring are necessary.

Its flexibility and fast integration with AWS services like CloudFront and ALB. It allows adding security controls such as rate limiting and IP blocking without changing the application itself.

It is not very transparent during detections and tuning, and it still misses some attack patterns unless rules are carefully customized and monitored continuously.

AWS WAF helps protect public applications from common attacks like bots, abusive traffic, and HTTP exploits without requiring application changes. It benefits us by reducing security risks, improving visibility, and allowing faster mitigation during incidents.

It protects against threats and hackers, and it lets us manage internet traffic according to our organization’s policy. It’s also easy to monitor the logs. There’s a large community and well-maintained documentation, plus support for centralized management. Customer support has been good as well. It provides a rich feature set for targeted protection, the ability to configure Web ACLs, and managing rule sets.

None, since the tool does deliver on the capabilities and features described in their whitepapers. That said, the pricing model is opaque, and we’ve been caught off guard by scaling costs before.

I have experience working with AWS WAF to protect web applications from common web exploits and to secure APIs against threats such as SQL injection, XSS, and bot traffic. I configured custom rules and integrated WAF with CloudFront and an Application Load Balancer to manage and control incoming traffic effectively.

Its native integration with CloudFront and ALB eliminates external latency while offering instant protection via Amazon-managed rules against OWASP threats. The pay-as-you-go model makes it accessible for any scale, allowing you to secure your infrastructure without upfront contracts. It is the ultimate "set and forget" solution for the AWS ecosystem.

Inspection & Capacity: Its strict 64 KB body inspection limit and 5,000 WCU cap can leave larger payloads unmonitored or force you to compromise on security depth.

Cost & Complexity: Native dashboards are basic, requiring paid CloudWatch/S3 logging and manual Athena queries just to visualize and tune frequent false positives.

The most practical aspect of AWS WAF is its native integration with the AWS ecosystem. The connection with CloudFront, Application Load Balancers, API Gateway, and AppSync creates a unified security layer without managing separate security tools or dealing with compatibility issues.

AWS Managed Rules handle OWASP Top 10 vulnerabilities, SQL injection, XSS, and bot traffic without writing and maintaining custom signatures. The Application Layer DDoS protection with automated mitigation actions provides protection against layer 7 attacks with detection times measured in seconds.

1) AWS WAF is very easy to deploy and requires no additional software installation, DNS, config, or SSL/TLS certifications management.

2) We can able to create customer rules for specific needs. These rules can be based on IP addresses, UPL strings, or even HTTP body content.

3) AWS WAF provides a strong defense mechanism against SQL injection, cross-site scripting, and DDoS attacks.

4) Developers can automate rule creation and deployment using AWS APIs or cloud formation templates, streamlining security management during application development and reducing manual effort.

.The simplicity of configuration and management

I actually does not have anything I don't like

The protection from threats and as a

Earlier we used to get millions of requests on our APIs in few seconds that was not possible from users, it seems like DDOS attack, which was taking lots of CPU and memory, costing us a lot, then we added WAF in cloud front to block bot attacks and detect and block IPs.

Overall it's good, but sometimes we do load testing it also block that IPs, it take that as bot attack. But this is also good but we want to whitelist some IPs that doesn't seems possible here, I guess..

It's preventing bot attacks for our APIs that was a big problem for us, after getting millions of request, our system starts automatically autoscaling that was not necessary, because that was not real traffic, costing us a lot.

AWS WAF is the web based firewall which has built-in DDOS attack protection to stop any DDOS attacks. Also, the AWS support team quickly responds to the queries or concerns raised.

There is no dislike about AWS WAF as it has good features.

The AWS WAF is the good application in securing the network where we can choose the deploying the rules by creating API rules. Also, it protects the web traffic of the applications securely with integration of various services.

Very easy to deploy and configure. There are managed rules and custom rule creation.

Log should contain more details about attack type and reason for block.

We have deployed WAF with ALB, and protecting application againt OWASP top10.