AWS WAF
WAF is the defensive layer that inspects incoming HTTP requests to public web endpoints and filters malicious patterns first. It blocks common web attacks before they reach application code.
▶Architecture Diagram
🔗 RelationshipDashed line animations indicate the flow direction of data or requests
Public web services see bots, scans, SQL injection attempts, and abusive traffic before requests ever reach the application. If you cannot filter that traffic at the front edge, the backend has to absorb legitimate and malicious requests together.
Early web applications put much of their defense logic inside app code, but the infrastructure and origin were already burdened before that code even ran. This is why WAF layers filtering requests at the edge and ingress became important.
WAF attaches rule sets in front of CloudFront, ALB, or API Gateway to inspect requests and block or allow them. Metrics and logs connect to CloudWatch and S3 for operational visibility.
WAF and IAM are both security services, but they block at different points. IAM controls credential-based permissions, while WAF filters incoming HTTP requests at public endpoints. If the issue is who can access AWS resources, look at IAM; if the issue is filtering malicious web traffic, look at WAF.
Well-suited for websites, public APIs, CDN distributions, bot defense, rate limiting, and common web attack prevention. User authentication or AWS inter-resource permission control is not WAF's role.