Intermediate LevelCloud Computing (AWS/GCP/Azure)
How do AWS WAF Custom Rules and Managed Rule Groups block malicious web traffic?
❓ Interview Prompt: Explain AWS WAF (Web Application Firewall) attachments (ALB, CloudFront, API Gateway), OWASP Top 10 rule groups, and rate limiting.
AWS WAF (Web Application Firewall) protects web applications and APIs against common web exploits (OWASP Top 10) that could affect availability, compromise security, or consume excessive resources.
Key Defense Features:
1
Managed Rule Groups: Pre-configured rules managed by AWS security teams (blocking SQL Injection, Cross-Site Scripting, Known Bad Inputs, Bot Control).
2
Rate-Based Rules: Automatically blocks client IP addresses that exceed a specified HTTP request threshold within a 5-minute window (e.g. max 1,000 req / 5 mins).
3
Attachments: Integrates directly with CloudFront distributions, Application Load Balancers (ALB), and API Gateway.
Code Implementation Example
hcl
# AWS WAF Web ACL with Rate-Based Rule
resource "aws_wafv2_web_acl" "waf" {
name = "web-app-firewall"
scope = "REGIONAL" # Or CLOUDFRONT for CDN
default_action { allow {} }
rule {
name = "rate-limit-rule"
priority = 1
action { block {} }
statement {
rate_based_statement {
limit = 1000 # 1,000 requests per 5 minutes per IP
aggregate_key_type = "IP"
}
}
visibility_config { cloudwatch_metrics_enabled = true; metric_name = "RateLimit"; sampled_requests_enabled = true }
}
}💡Terraform AWS WAF Web ACL configuration enforcing rate-based IP blocking.
🎯 Interview Key Takeaway
AWS WAF inspects HTTP traffic at ALBs or CloudFront, blocking OWASP Top 10 attacks and rate-limiting abusive client IPs.
#AWS WAF#Security#Firewall#Rate Limiting#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→