Inspects HTTP requests and decides in rule order

Rules · labels

Rules are JSON statements; labels carry decisions forward

Below is a rate-based rule that limits requests per IP on the login path, excluding requests that carry the corporate-IP label. Using labels added by earlier rules as conditions in later rules lets you split rules into small pieces and combine them.

{
  "Name": "rate-limit-login",
  "Priority": 4,
  "Statement": {
    "RateBasedStatement": {
      "Limit": 100,
      "EvaluationWindowSec": 300,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": { "AndStatement": { "Statements": [
        { "ByteMatchStatement": { "SearchString": "/api/login",
            "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH",
            "TextTransformations": [{ "Priority": 0, "Type": "LOWERCASE" }] } },
        { "NotStatement": { "Statement": { "LabelMatchStatement": {
            "Scope": "LABEL", "Key": "corp:trusted-ip" } } } }
      ] } }
    }
  },
  "Action": { "Block": {} },  // Allow is not supported
  "VisibilityConfig": { "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true, "MetricName": "rate-limit-login" }
}

Features

Key features

Custom responses: specify a status code, headers, and body on a Block action to return a custom response, and with Allow or Count you can insert custom headers into requests forwarded to the origin.

Protected resources

Resources you can associate a web ACL with

One web ACL can be associated with multiple resources of the same scope, but each resource can have only one web ACL. Create web ACLs for CloudFront in the global scope, and all others in the same Region as the resource.

You can't associate a web ACL directly with an NLB, an API Gateway HTTP API, or an EC2 Elastic IP. Protect such entry points by placing CloudFront in front, or with Shield Advanced and Network Firewall.

Where it fits

AWS WAF and neighboring security services

They work at different layers and inspect different things, so they complement rather than replace each other.

Reference architecture

Filter at the edge first, and apply one baseline across the organization

Web traffic is inspected first at CloudFront, which has a global web ACL associated. The Regional API Gateway gets a Regional web ACL. Firewall Manager enforces common rule groups across every account in the organization, and logs from each web ACL are collected in one place.

Getting started

Steps to deploy your first web ACL

1. STEP 1

   Create a web ACL

   Choose the scope of the resources to protect (CloudFront or Regional) and set the default action. The new console shows it as a protection pack.

2. STEP 2

   Add managed rules

   Add AWS Managed Rules such as Core rule set and IP reputation, and check WCU usage.

3. STEP 3

   Observe with Count

   Keep rules in Count, enable logging and CloudWatch metrics, find false positives, and create exceptions.

4. STEP 4

   Switch to Block

   Switch verified rules to Block first, then add rate-based rules and Bot Control.

5. STEP 5

   Scale to the organization

   Use Firewall Manager policies to apply common rule groups automatically to all accounts and new resources.

Pricing

Cost components

You pay for what you use. The basics are monthly charges per web ACL and per rule, plus the number of requests processed; enabling intelligent threat mitigation features and extended options adds charges.

For resources protected by Shield Advanced, standard AWS WAF charges are included in the subscription (excluding Bot Control, Fraud Control, CAPTCHA, and similar). For CloudFront distributions you can also choose flat-rate pricing plans (launched November 2025) that include AWS WAF and DDoS protection in a monthly fee. Prices are subject to change; check the AWS WAF pricing page.