What is AWS WAF? A plain-English explainer

What a web application firewall is, and how it differs from a network firewall

Our what-is-a-firewall explainer covers the general concept: a system that filters traffic based on rules, deciding what to let through and what to block. A traditional network firewall operates at a lower level — looking at things like IP addresses, ports and protocols, largely blind to the content of a web request itself.

A web application firewall operates one layer up, at the application layer, where it can actually read the content of an HTTP or HTTPS request — the path being requested, the headers sent, the data in the body — and make a filtering decision based on what that content looks like. That is what lets WAF catch attacks that a network firewall, by design, simply cannot see.

What AWS WAF protects against, conceptually

AWS WAF filters requests against rules that look for patterns associated with common web application attacks, unwanted automated traffic, and requests that could overwhelm an application. In broad terms, that covers:

• Common web exploits — request patterns associated with well-known categories of attack against web applications.
• Bad bots and unwanted automated traffic — requests that do not look like a genuine user browsing the site.
• Request flooding — an unusually high rate of requests from a source, which WAF rules can rate-limit.

Where WAF sits

AWS WAF attaches in front of the services that actually receive web traffic — most commonly Amazon CloudFront (covered in our what-is-amazon-cloudfront explainer), Application Load Balancers, and API Gateway. Requests pass through WAF’s rules before they reach the application behind it, so unwanted traffic is filtered out before it ever consumes application resources.

This positioning matters: WAF is not something you install on a server, and it is not tied to any one application’s code. It sits at the edge of the traffic path, which is why the same set of rules can protect several different services consistently.

WAF and AWS Shield — complementary, not the same thing

AWS Shield is a separate service focused on protecting against distributed denial-of-service (DDoS) attacks — attempts to overwhelm a service with sheer volume of traffic rather than crafted, malicious-looking requests. WAF and Shield are complementary rather than substitutes for each other: Shield is about surviving a flood of traffic, while WAF is about filtering out requests that look malicious or unwanted regardless of volume. Many applications use both together.

Common uses

Typical reasons teams put AWS WAF in front of an application include blocking known attack patterns against a public-facing website, filtering out scraping bots and other unwanted automated traffic, applying rate-based rules to slow down abusive request volumes, and adding a managed layer of application-level protection without writing custom filtering logic into the application itself.

Where AWS WAF appears in certification study

AWS WAF is core content on Security Specialty, where application-layer protection is tested in depth alongside network-layer controls, and it appears at a lighter, conceptual level in architecture-focused study — knowing that WAF exists and where it sits in front of CloudFront, load balancers and API Gateway is the level expected there.

This article covers what WAF is and why it exists — the syllabus depth on writing specific rule groups and rate-based rules belongs in the exam guide itself, which our /revision study library covers lesson by lesson.