AWS WAF rate limiting is not working as expected.

Question

Hi,

I have a rest API deployed on ECS and fronted with an ALB. I set a rule on WAF to block DDOS attack. 
If there are more than 10 request in one minute, then the requests should block. However, it is not working as expected.
When I send 150 request at the same time, Some time, 120 is returning 200 and 30 returning 429 response (I manually set on WAF in case of blocked response) Sometime, 110 returning 200 and 40 429 etc.

The expected case, 10 should return 200 and 140 should return 429 response.

Am I missing something?

Here is the rule JSON data:

{
  "Name": "PreventDDOSAnonymousEndpoint",
  "Priority": 0,
  "Statement": {
    "RateBasedStatement": {
      "Limit": 10,
      "EvaluationWindowSec": 60,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/api/website/",
          "FieldToMatch": {
            "UriPath": {}
          },
          "TextTransformations": [
            {
              "Priority": 0,
              "Type": "LOWERCASE"
            }
          ],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  },
  "Action": {
    "Block": {
      "CustomResponse": {
        "ResponseCode": 429,
        "CustomResponseBodyKey": "DDOS-RESPONSE",
        "ResponseHeaders": [
          {
            "Name": "test",
            "Value": "test"
          }
        ]
      }
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "PreventDDOSAnonymousEndpoint"
  }
}

Tracy H · Answer

The 150 requests you are sending at the same time are most likely coming in at too high of a rate for the WAF to detect and limit them. AWS WAF will catch up and eventually trigger the rule.

Take a look at the [Rate-based rule caveats](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based-caveats.html) for more detail.

> Each time that AWS WAF estimates the rate of requests, AWS WAF looks back at the number of requests that came in during the configured evaluation window. Due to this and other factors such as propagation delays, it's possible for requests to be coming in at too high a rate for up to several minutes before AWS WAF detects and rate limits them. Similarly. the request rate can be below the limit for a period of time before AWS WAF detects the decrease and discontinues the rate limiting action. Usually, this delay is below 30 seconds.

AWS WAF rate limiting is not working as expected.

Relevant content