c3.16 Add custom AWS WAF rules

Beyond managed rules

AWS WAF managed rules protect against common threats quickly, but some protections are application-specific. Author custom rules in the console or as JSON (export console rules to JSON for version control) to cover:

Rate limiting

Set request-rate limits sized to your application's normal traffic to blunt Layer 7 DDoS (HTTP floods), bot attacks (credential stuffing), and reconnaissance. Start a rule in Count mode, confirm normal usage stays under the threshold, then switch it to Block. You can also rate-limit by geography where traffic is unexpected.

Virtual patching

When a vulnerability is found and cannot be fixed in code immediately, deploy a custom rule as a temporary "virtual patch" — for example, block form submissions containing characters used in a detected SQL-injection path — until the code fix ships.

Protect signup and login

• Account Creation Fraud Prevention (ACFP) protects the registration form against fake or abusive sign-ups (for example abusing free tiers).
• Account Takeover Prevention (ATP) protects the login form against credential stuffing and password spraying.

When to consider a partner WAF

Evaluate whether AWS WAF meets your needs or a partner WAF (Imperva, F5, Fortinet on the AWS Marketplace) fits better — either as SaaS (point domains at the provider) or as virtual appliances in an ingress VPC.

Example: a rate-based rule

This WAF rule limits requests per source IP over a 5-minute window. Start with Count to confirm the threshold, then change the action to Block:

{
  "Name": "rate-limit-per-ip",
  "Priority": 10,
  "Statement": {
    "RateBasedStatement": {
      "Limit": 2000,
      "AggregateKeyType": "IP"
    }
  },
  "Action": { "Count": {} },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "rate-limit-per-ip"
  }
}