All 7 AWS WAF & Shield questions
More in AWS WAF & Shield
What is AWS WAF and how does it protect web applications from common attacks? What is AWS Shield, and what is the difference between Shield Standard and Shield Advanced? How do AWS WAF managed rule groups simplify protecting applications against common, well known attack patterns? How does AWS WAF Bot Control help distinguish between legitimate automated traffic and malicious bots? How does AWS Shield Advanced provide cost protection and access to specialized DDoS response support during a major attack? How should an organization design a layered defense in depth strategy combining WAF, Shield, security groups, and network ACLs to protect a public facing application?
Advertisement
AWS › AWS WAF & Shield

How does rate based rules in AWS WAF help mitigate application layer DDoS attacks and abusive traffic patterns?

Intermediate

Answer

A rate based rule in WAF automatically tracks the number of requests coming from a specific source IP address over a rolling five minute window, and if that count exceeds a threshold you define, WAF automatically blocks further requests from that source until the rate drops back below the threshold, providing an effective defense against application layer attacks like credential stuffing or content scraping that traditional network layer DDoS protections might not fully address.
aws wafv2 create-rule-group --name rate-limit-rule --scope REGIONAL --capacity 10 --rules '[{"Name":"RateLimit","Statement":{"RateBasedStatement":{"Limit":2000,"AggregateKeyType":"IP"}}}]'
Real-world example A login page under a credential stuffing attack, where an attacker rapidly attempts many username and password combinations, uses a WAF rate based rule to automatically block any single IP address making more than a reasonable number of login attempts within five minutes.

Common follow-ups: What is the minimum rate limit threshold that can be configured for a rate based rule?;How do you handle legitimate high volume traffic sources like shared corporate networks?

AWS Security Hub & GuardDuty;Amazon API Gateway
All 7 AWS WAF & Shield questions