AWS WAF Web ACLs, Rules, and Web Exploit Protection – SAP-C02 Study Guide

Purpose of This Lesson

AWS WAF is a web application firewall used to inspect and control HTTP and HTTPS requests before they reach supported AWS application endpoints. For the SAP-C02 exam, the key decision is recognizing when a solution needs application-layer filtering rather than only network-level controls.

AWS WAF is especially relevant when protecting applications exposed through:

• Amazon CloudFront
• An Application Load Balancer (ALB)
• Amazon API Gateway
• AWS AppSync GraphQL APIs

It can help detect and block common web exploits such as SQL injection and cross-site scripting (XSS), as well as filter traffic by IP address, geography, request content, and rate.

Key Concepts

Web ACLs

A web access control list, or web ACL, is the primary AWS WAF policy attached to a supported resource. It contains rules that inspect incoming web requests and determine whether those requests should be allowed, blocked, or counted.

A web ACL can protect resources associated with a CloudFront distribution, ALB, API Gateway API, or AppSync API. The exact association depends on the resource and AWS WAF scope being used.

Rules and Statements

A rule defines both:

1. The conditions used to inspect a request
2. The action taken when the request matches those conditions

The inspection logic is represented by a statement. Statements can evaluate characteristics such as:

• Source IP address or IP range
• Geographic origin
• HTTP headers
• Request body
• URI path or other request strings
• Request size
• SQL injection patterns
• Cross-site scripting patterns
• Regular expression matches

Rules can be used individually or organized into rule groups. Rule groups are useful for packaging and reusing related inspection logic.

Rule Actions

The lesson emphasizes three core actions:

• Allow: Permit the request to continue to the protected application.
• Block: Reject the request. A blocked request generally receives an HTTP 403 Forbidden response.
• Count: Record matching requests without allowing the rule to block them. Count is useful for monitoring and validating a new rule before enforcing it.

AWS WAF evaluates the rules in a web ACL according to their configured evaluation order. The final web ACL behavior must be considered when multiple rules could match the same request.

IP Sets

An IP set is a reusable collection of IPv4 or IPv6 addresses and CIDR ranges. It can be referenced by a rule to allow or block traffic from known networks.

Typical uses include:

• Blocking known malicious addresses
• Allowing traffic from corporate offices or trusted partners
• Denying traffic from a maintained list of abusive sources

An IP set separates the address data from the rule logic, making address-list maintenance easier.

Regex Pattern Sets

A regex pattern set contains regular expressions that can be referenced by a rule. This allows WAF to identify request strings matching organization-specific patterns, such as suspicious URI paths, headers, or parameters.

Regex matching should be designed carefully. Overly broad patterns can create false positives, while overly narrow patterns may fail to detect malicious requests.

Request Inspection Criteria

AWS WAF can inspect multiple parts of a web request and its origin. Common criteria include:

• Geographic match: Match requests based on geographic origin.
• IP set match: Match source IP addresses or ranges.
• String match: Search for specified text in selected request components.
• Regex match: Compare request content with regular expressions.
• Size constraint: Match requests or selected components that exceed a configured size condition.
• SQL injection match: Detect patterns associated with SQL injection attempts.
• Cross-site scripting match: Detect patterns associated with XSS attacks.

These controls operate at the web-request layer. AWS WAF should not be confused with a network firewall that primarily filters traffic by IP protocol, port, and network interface.

Rate-Based Filtering

Rate-based rules identify clients that exceed a configured request rate over a time window. They are useful for limiting abusive request behavior, such as repeated requests against a login endpoint or a public API.

Rate-based filtering is a control for request volume and abuse mitigation; it is not a replacement for application authentication, authorization, or a full DDoS protection strategy.

Typical Request Flow

A simplified architecture looks like this:

Internet clients
      |
      v
CloudFront + AWS WAF  ---> Origin application

Internet clients
      |
      v
ALB + AWS WAF  -------> EC2 or other ALB targets

Internet clients
      |
      v
API Gateway + AWS WAF -> API integration

Internet clients
      |
      v
AppSync + AWS WAF -----> GraphQL API resolvers and data sources

The important exam pattern is that WAF is placed at the entry point serving the web application or API, rather than directly on an EC2 instance.

Exam-Relevant Takeaways

• AWS WAF protects against web-layer attacks, including SQL injection and cross-site scripting.
• A web ACL is associated with a supported AWS resource and contains inspection rules.
• WAF can protect applications delivered through CloudFront, ALB, API Gateway, and AppSync.
• Use IP sets for reusable lists of addresses and CIDR ranges.
• Use regex pattern sets for reusable regular-expression matching logic.
• A rule can inspect IP address, geography, headers, URI, body, strings, request size, and attack signatures.
• Use Count to observe matching traffic without immediately denying it.
• Use Block when matching requests must be rejected; the client commonly receives 403 Forbidden.
• Use Allow when a matching request should proceed.
• Rate-based rules help control excessive request rates and abusive clients.
• If an exam question mentions SQL injection or XSS and the application is behind CloudFront, an ALB, API Gateway, or AppSync, AWS WAF is a strong candidate.

Architecture Decision Guide

Requirement	AWS WAF capability or design choice
Block common SQL injection attempts	SQL injection match statement in a web ACL rule
Detect common cross-site scripting attempts	Cross-site scripting match statement
Block known malicious source networks	IP set referenced by a blocking rule
Allow only traffic from selected locations	Geographic match with an allow rule and appropriate default behavior
Block requests from selected countries or regions	Geographic match with a blocking rule
Detect custom request patterns	String match or regex pattern set
Reject unusually large requests	Size-constraint statement
Observe a rule before enforcing it	Use the Count action and review metrics/logs
Reduce abusive high-volume requests	Rate-based rule
Protect a CloudFront-delivered web application	Associate a web ACL with the CloudFront distribution
Protect an application exposed through an ALB	Associate a web ACL with the ALB
Protect an API Gateway API	Associate a web ACL with the API Gateway resource
Protect an AppSync GraphQL API	Associate a web ACL with the AppSync API

Common Exam Traps

• Confusing WAF with a network firewall: WAF evaluates web requests and application-layer content. It is not the primary tool for generic security-group or subnet traffic filtering.
• Choosing WAF for every DDoS problem: WAF can help with HTTP request filtering and rate control, but the question may require a broader DDoS architecture depending on the attack and required protections.
• Assuming WAF runs directly on EC2: WAF is associated with supported front-end AWS resources such as CloudFront or an ALB; it is not installed as an agent on an EC2 instance.
• Using an IP allowlist to solve application authorization: IP filtering does not replace user authentication, IAM, API authorization, or resource-level permissions.
• Forgetting the protected entry point: If users access the application through CloudFront, attach the web ACL to CloudFront. If they access it through an ALB, associate it with the ALB.
• Treating Count as Block: Count records matching traffic but does not deny it. It is useful for testing and tuning.
• Missing the web-exploit keywords: SQL injection and XSS strongly indicate an application-layer web filtering requirement.
• Assuming geographic filtering proves user identity: Geo matching uses request-origin information; it is not a secure identity or authorization mechanism.

Real-World Engineer Notes

• Start new rules in Count mode when possible. Review false positives and legitimate traffic before changing the action to Block.
• Use managed or reusable rule groups where appropriate, but validate their behavior against the application’s normal request patterns.
• Keep IP sets and regex pattern sets separate from rule definitions so security teams can update indicators without redesigning the entire web ACL.
• Rate-based rules are particularly useful for login, search, checkout, and API endpoints that are attractive targets for automated abuse.
• WAF rules should complement secure application development practices. They do not correct vulnerable SQL construction, missing input validation, weak authentication, or broken authorization.
• Monitor blocked and counted requests and investigate unexpected geographic, IP-based, or pattern-based matches.
• Be precise about the request path in the architecture. A web ACL on CloudFront protects traffic arriving through that distribution, while a separately exposed origin or API endpoint may require additional protection.

Quick Reference Summary

• Service: AWS WAF
• Primary purpose: Filter HTTP and HTTPS web requests before they reach supported application resources.
• Policy container: Web ACL
• Policy components: Rules, statements, rule groups, IP sets, and regex pattern sets
• Key match types: IP, geography, headers, body, URI, strings, regex, size, SQL injection, and XSS
• Core actions: Allow, Block, and Count
• Common protected services: CloudFront, ALB, API Gateway, and AppSync
• Best exam clue: Common web exploits such as SQL injection or cross-site scripting
• Important distinction: WAF is an application-layer control, not a replacement for security groups, network firewalls, identity controls, or secure coding

Flashcards

1. Q: What is AWS WAF used for?

A: Inspecting and filtering web requests to protect applications from application-layer threats and unwanted traffic.

1. Q: What is a web ACL?

A: A collection of AWS WAF rules associated with a supported resource to control incoming web requests.

1. Q: Which AWS services commonly integrate with AWS WAF?

A: CloudFront, Application Load Balancer, API Gateway, and AWS AppSync.

1. Q: Which two common web exploits are strongly associated with AWS WAF exam questions?

A: SQL injection and cross-site scripting.

1. Q: What does an AWS WAF IP set contain?

A: IPv4 or IPv6 addresses and CIDR ranges that rules can match.

1. Q: What is the purpose of a regex pattern set?

A: To store reusable regular expressions for matching request content.

1. Q: What does the Count action do?

A: Counts matching requests without blocking them, allowing the rule to be tested and monitored.

1. Q: What does the Block action generally return to a client?

A: An HTTP 403 Forbidden response.

1. Q: What type of problem does a rate-based rule address?

A: Excessive request rates or abusive high-volume traffic from clients.

1. Q: Can AWS WAF inspect more than the source IP address?

A: Yes. It can inspect geography, headers, body, URI, strings, request size, and attack patterns.

1. Q: Is AWS WAF a replacement for a security group?

A: No. WAF filters web requests, while security groups control network traffic to resources such as ENIs.

1. Q: Where should WAF be associated when a web application is delivered through CloudFront?

A: With the CloudFront distribution serving the application.

Practice Questions

Question 1

A company hosts a web application behind an Application Load Balancer. Security testing identifies possible SQL injection and cross-site scripting attempts. Which solution directly addresses these threats at the application entry point?

A. Add inbound security-group rules for ports 80 and 443
B. Associate an AWS WAF web ACL with the ALB
C. Add a network ACL denying traffic from external IP addresses
D. Encrypt the ALB target-group connections with TLS

Correct answer: B

Explanation: AWS WAF provides application-layer inspection for SQL injection and XSS and can be associated with an ALB. Security groups, network ACLs, and TLS address different concerns.

Question 2

A security team has a list of known malicious CIDR ranges that must be blocked across several web applications. Which AWS WAF feature should store the list for reuse in rules?

A. Regex pattern set
B. IP set
C. Rule group
D. Geographic match

Correct answer: B

Explanation: An IP set stores IP addresses and CIDR ranges that can be referenced by one or more AWS WAF rules.

Question 3

An organization wants to deploy a new AWS WAF rule but first needs to determine how many legitimate requests would match it. Which action should be configured initially?

A. Allow
B. Block
C. Count
D. Redirect

Correct answer: C

Explanation: Count records matching requests without denying them. This supports rule validation and false-positive analysis before enforcement.

Question 4

A public API is receiving automated bursts of requests from individual clients. The company wants to limit clients that exceed a request-rate threshold. Which AWS WAF capability is most appropriate?

A. Rate-based rule
B. Regex pattern set
C. Size-constraint statement
D. Geographic match

Correct answer: A

Explanation: Rate-based rules identify clients that exceed a configured request rate and are designed for request-volume abuse mitigation.

Question 5

A company serves its application through a CloudFront distribution. The security team creates an AWS WAF web ACL, but malicious requests continue to reach the application because the ACL is not associated with the distribution. What is the required correction?

A. Install the web ACL on each EC2 instance
B. Associate the web ACL with the CloudFront distribution
C. Attach the web ACL to the VPC route table
D. Add the web ACL to the security group used by the origin

Correct answer: B

Explanation: AWS WAF protects supported front-end resources through resource association. For traffic entering through CloudFront, the web ACL should be associated with the CloudFront distribution.