AWS WAF Guide: Stop SQL Injection, XSS & Bad Bots Explained

Welcome to the AWS Zero to Hero Security Series

When building applications on AWS, performance and scalability are usually top priorities. However, the moment your application goes live, it becomes a target. From automated scrapers to malicious hackers attempting to breach your database, threats are constant. This is where AWS WAF (Web Application Firewall) becomes essential.

In this AWS Zero to Hero series, we dive deep into how AWS WAF works, why it is critical for your infrastructure, and how to configure it to stop common web attacks like SQL Injection and Cross-Site Scripting (XSS).

What is AWS WAF?

AWS WAF is a web application firewall that protects your web applications and APIs from common web exploits and bots that can compromise security, affect availability, or consume excessive resources. Unlike traditional firewalls that block traffic based solely on IP addresses, AWS WAF operates at Layer 7 (the Application Layer). This allows it to inspect the actual content of HTTP/S requests.

You can deploy AWS WAF on several AWS services, including:

• Amazon CloudFront: To protect your global content delivery network (CDN).
• Application Load Balancer (ALB): To secure regional traffic.
• Amazon API Gateway: To protect RESTful and WebSocket APIs.
• AWS AppSync: To secure GraphQL APIs.

The ‘Big Three’ Web Threats You Must Stop

To master AWS security, you must understand the threats you are defending against. AWS WAF is specifically engineered to mitigate these common vulnerabilities:

1. SQL Injection (SQLi)

SQL Injection occurs when an attacker inserts malicious code into a web form or API query string. If your application doesn’t sanitise inputs, that code could execute on your backend database, leading to data leaks or deleted tables. AWS WAF features built-in inspection rules that identify common SQL patterns and block malicious requests before they reach your server.

2. Cross-Site Scripting (XSS)

XSS attacks involve injecting malicious scripts into web pages viewed by other users to steal session cookies or redirect traffic to phishing sites. AWS WAF inspects HTTP request components—including the body, headers, and query strings—for script tags and XSS patterns to neutralize threats at the edge.

3. Malicious Bots and Scrapers

While some bots are beneficial (like Google’s crawler), many are harmful. Malicious bots attempt to brute-force login pages, scrape proprietary pricing data, or overwhelm system resources. AWS WAF Bot Control provides a managed solution to identify and block automated threats while allowing legitimate traffic to pass through uninterrupted.

Setting Up Your First Web ACL

To begin, you create a Web ACL (Access Control List). Think of this as your central security policy where you define “Rules” and “Rule Groups.”

For those new to AWS, the AWS Managed Rules feature is a game-changer. These rule sets are maintained by AWS security experts. Instead of writing complex regular expressions (regex) yourself, you can enable the Core Rule Set (CRS), which covers the OWASP Top 10 vulnerabilities. It is a “set it and forget it” way to instantly boost your security posture.

Key Benefits of AWS WAF

• Agility: Update rules in seconds to respond to emerging threats in real-time.
• Cost-Effectiveness: Pay only for what you use based on the number of rules and the volume of web requests.
• Visibility: Gain detailed insights via Amazon CloudWatch, showing which rules are being triggered and the origin of your traffic.
• Customization: Create custom rules to block or allow traffic based on country of origin, IP address, or specific header values.

Best Practices for Your Security Journey

As you implement AWS WAF, keep these professional tips in mind:

1. Use ‘Count’ Mode First: Before setting a rule to “Block,” use “Count” mode. This allows you to monitor how many requests would have been caught without actually stopping them, helping you avoid “false positives” that could block legitimate users.
2. Prioritise Rule Order: Rules are processed in the order they appear in the Web ACL. Place your most critical or specific rules at the top to optimise processing and ensure your primary defenses are checked first.

Conclusion

Security should never be an afterthought. By integrating AWS WAF into your architecture, you are building a robust perimeter to protect your data and users. Whether you are preventing SQL Injection or reducing bot traffic, AWS WAF is a primary tool for every AWS Hero. Ready to secure your application? Head over to the AWS Management Console and deploy your first Managed Rule set today!