Skip to main content

AWS WAF

Overview​

AWS WAF (Web Application Firewall) is a security service provided by Amazon Web Services.
It helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

Key features:

  • Protects against SQL injection, XSS, and other attacks
  • Customizable rules and managed rule sets
  • WebACLs (Access Control Lists) to define allowed or blocked traffic
  • Integration with CloudFront, API Gateway, and Application Load Balancer

AWS WAF Waste​

AWS WAF can also contain "waste" if not properly managed:

  • WebACLs that are no longer attached to any resource
  • Rules that are unused or redundant
  • Overly broad rules that allow unnecessary traffic
  • Managed rules that are outdated or misconfigured
  • Unmonitored WAFs leading to missed alerts and potential costs

WebACLs and Rules​

A WebACL is a collection of rules that define what traffic is allowed or blocked.

  • Each WebACL can contain multiple rules, including rate-based, IP-based, and managed rule sets.
  • AWS WAF counts rules and metrics, allowing monitoring of traffic patterns and potential security risks.
  • Rules should be regularly reviewed to ensure they remain relevant and efficient.

How DiscountCloud Uses AWS WAF​

DiscountCloud tracks AWS WAF WebACLs linked to each AwsAccount.

This enables:

  • Security monitoring – detecting unused or misconfigured WebACLs
  • FinOps monitoring – identifying potentially unnecessary WAF rules that could increase costs
  • Compliance – ensuring that all web applications have adequate protection

By syncing WebACLs from AWS, DiscountCloud maintains a centralized view of all active WAF protections and highlights inefficiencies or potential waste.