AWS Builder Center: Learn, Build and Connect with builders in the AWS community

AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.

How do I use AWS WAF to mitigate DDoS attacks?

11 minute read

I want to use AWS WAF protection pack to mitigate distributed denial of service (DDoS) attacks at the application layer.

Short description

To use AWS WAF as the primary mitigation against application-layer DDoS attacks, use the following methods:

Use rate-based rules.
Query the AWS WAF logs to gather specific information about unauthorized activity.
Create a geographic match rule to block requests from a country that isn't expected for your business.
Create an IP set match rule to block requests from specific IP addresses.
Create a string match rule to block requests.
Create a regex match rule to block requests.
Turn on Bot Control and use the targeted protection level.
Use the Amazon IP reputation list managed rule group.
Turn on the Anti-DDoS managed rule group.

For infrastructure-layer attacks, use AWS services such as Amazon CloudFront and Elastic Load Balancing (ELB) to provide automatic DDoS protection. For more information, see AWS best practices for DDoS resiliency. You can also use AWS Shield Advanced Automatic Application Layer to mitigate sophisticated attacks, such as layer 3–7. For more information, see Automating application layer DDoS mitigation with Shield Advanced.

Resolution

Use rate-based rules

Create a blanket rate-based rule

Use a blanket rate-based rule to set a threshold for the number of requests that IP addresses can make to your web application.

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose Custom rule, and then choose Next.
Choose Rate based rule, and then choose Next.
To set up your rule, configure the following values:
For Action, select Block.
For Name, enter a rule name.
For Rate limit, enter a number between 10 and 2,000,000,000.
For Evaluation window, enter 1, 2, 5, or 10 minutes.
In the Rule configuration block dropdown:
For IP address to use for rate limiting, select Source IP address or IP address in header.
For Scope of inspection, select Consider all requests.
Choose Create Rule.

Note: If you're not sure what rate limit to set, then use the rule action to count and monitor your request patterns. Then, set a rate limit based on your baseline.

After you submit a request rate change, you might experience a delay for AWS WAF to apply or remove the rule action.

Create a custom key (URI path) rate-based rule

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose Custom rule, and then choose Next.
Choose Rate based rule, and then choose Next.
To set up your rule, configure the following values:
For Action, select Block.
For Name, enter a rule name.
For Rate limit, enter a number between 10 and 2,000,000,000.
For Evaluation window, enter 1, 2, 5, or 10 minutes.
In the Rule configuration block dropdown:
Under Rule configuration, select Custom Keys.
For Request aggregation keys, select URI path.
For Text transformations, choose None.
For Scope of inspection, select Consider all requests.
Choose Create Rule.

Note: After you submit a request rate change, you might experience a delay for AWS WAF to apply or remove the rule action.

For more information, see The three most important AWS WAF rate-based rules.

Query the AWS WAF logs to gather specific information about unauthorized activity

Turn on AWS WAF logging. Then, query the AWS WAF logs to investigate DDoS scenarios.

You can use the following AWS services to query AWS WAF logs:

Amazon CloudWatch Logs
Amazon Athena
Amazon OpenSearch Service and Amazon QuickSight

Use the Amazon Athena log parser or AWS Lambda log parser

AWS WAF has a minimum acceptable rate limit for rate-based rules. If you can't use rate-based rules because of low volume or need a customizable block period, use a log parser in Athena or Lambda. Both services are available in Security Automations for AWS WAF.

Create a geographic match rule to block requests from a country that isn't expected for your business

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose Geo-based rule.
To set up your rule, configure the following values:
For Rule action, choose Block.
For Name, enter a rule name.
Under Statement, choose the country codes that you want to block.
Choose Create Rule.

For more information, see Geographic match rule statement.

Create an IP set match rule to block requests from specific IP addresses

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose IP based rule, and then choose Next.
To set up your rule, configure the following values:
For Rule action, choose Block.
For Name, enter a rule name.
Under Statement, activate Use existing IP set and choose the IP set.
Choose Create Rule.

For more information, see IP set match rule statement.

Create a string match rule to block requests

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose Custom rule, and then choose Next.
Choose Custom rule again, and then choose Next.
For Rule action, choose Block.
To set up your rule, configure the following values:
For Name, enter a rule name.
For If the request, select match the statement.
For Inspect, choose Header.
For Header field name, enter the name of the bot you want to block as it appears in your AWS WAF logs.
For Match Type, select Exactly matches string.
For String to Match, enter the value of the bot that you want to block as it appears in your AWS WAF logs.
Choose Create Rule.

For more information, see String match rule statement.

Create a regex match rule to block requests

Complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose Custom rule, and then choose Next.
Choose Custom rule again, and then choose Next.
To set up your rule, configure the following values:
For Rule action, choose Block.
For Name, enter a rule name.
For If the request, choose match the statement.
For Inspect, choose URI Path.
For Match type, select Matches regular expression.
For String to match, enter the regex that you want to block.
Choose Create Rule.

For more information, see Regex match rule statement.

Turn on Bot Control and use the targeted protection level

The targeted protection level for AWS WAF Bot Control uses a combination of rate limiting, CAPTCHA, and Challenge actions to decrease bot activity. For information about targeted Bot Control pricing, see AWS WAF Pricing.

To turn on Bot Control and the targeted protection level, complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose AWS-managed rule group, and then choose Next.
Under Paid, select Bot Control rule group.
Under Inspection level, select Targeted.
Choose Create rule.

Use the Amazon IP reputation list managed rule group

The AWSManagedIPReputationList managed rule group uses Amazon internal threat intelligence to identify IP addresses that have actively engaged in DDoS activities.

To turn on the Amazon IP reputation list managed rule group, complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose AWS-managed rule group, and then choose Next.
Under Free rules, select AmazonIpReputationList.
Choose Create rule.

Turn on the Anti-DDoS managed rule group

The AWSManagedRulesAntiDDoSRuleSet managed rule group detects and mitigates application layer (Layer 7) DDoS attacks within seconds. The rule group uses intelligent detection to establish traffic baselines. It provides soft mitigations (silent browser challenges) and hard mitigations (blocking) for DDoS requests. For information about Anti-DDoS managed rule group pricing, see AWS WAF Pricing.

To turn on the Anti-DDoS managed rule group, complete the following steps:

Open the AWS WAF console.
For Region, choose the AWS Region where you created your protection pack.
In the navigation pane, choose Resources & protection packs.
On the right side of protection pack, choose the icon next to the Region name to choose the protection pack.
In your protection pack, choose Rules.
Choose View and edit next to Rules to view or modify the rules associated with your protection pack.
In the right pane for Manage rules, choose Add rules.
Choose AWS-managed rule group, and then choose Next.
Under Paid, select Anti-DDoS rule group.
Configure the rule group settings:
For Block sensitivity level, select Low, Medium, or High.
For Enable challenge, choose whether to activate challenge actions during events.
(Optional) If challenge is activated, for Challenge sensitivity level, select Low, Medium, or High.
(Optional) For Exempt URI regular expressions, enter a regex for URIs that can't handle a silent browser challenge.
Choose Create rule.

Place the Anti-DDoS managed rule group near the top of the rule priority list, immediately after any custom IP allow or block list rules. This placement allows the rule group to evaluate maximum traffic and establish an accurate baseline. Your explicit allow and block decisions still take priority.

Important: Don't use a scope-down statement with this rule group. Scope-down limits the requests observed and results in inaccurate baselines and diminished DDoS detection.