AWS WAF

AWS WAF

About TrustRadius Scoring
Score 8.8 out of 100
AWS WAF

Overview

Recent Reviews

Reviewer Pros & Cons

View all pros & cons

Video Reviews

Leaving a video review helps other professionals like you evaluate products. Be the first one in your network to record a review of AWS WAF, and make your voice heard!

Pricing

View all pricing

Resource Type - Request

$0.60

Cloud
per 1 million requests

Resource Type - Rule

$1.00

Cloud
per month (prorated hourly)

Resource Type - Web ACL

$5.00

Cloud
per month (prorated hourly)

Entry-level set up fee?

  • No setup fee

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting / Integration Services

Features Scorecard

No scorecards have been submitted for this product yet..

Product Details

What is AWS WAF?

Amazon Web Services offers AWS WAF (web application firewall) to protect web applications from malicious behavior that might impede the applications functioning and performance, with customizable rules to prevent known harmful behaviors and an API for creating and deploying web security rules.

AWS WAF Technical Details

Deployment TypesSaaS
Operating SystemsUnspecified
Mobile ApplicationNo

Comparisons

View all alternatives

Frequently Asked Questions

What is AWS WAF?

Amazon Web Services offers AWS WAF (web application firewall) to protect web applications from malicious behavior that might impede the applications functioning and performance, with customizable rules to prevent known harmful behaviors and an API for creating and deploying web security rules.

What is AWS WAF's best feature?

Reviewers rate Support Rating highest, with a score of 9.1.

Who uses AWS WAF?

The most common users of AWS WAF are from Enterprises (1,001+ employees) and the Computer Software industry.

Reviews and Ratings

 (21)

Ratings

Reviews

(1-7 of 7)
Companies can't remove reviews or game the system. Here's why
Vinit Sharma | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Review Source
Web applications are very vulnerable to attacks and deploying your applications from the cloud can expose them to even greater risk. To help secure their cloud web apps, administrators will use a Web Application Firewall. We deployed all the applications and servers on the AWS cloud, so we need more security. That is why we are using the AWS Web Application Firewall. WAF provides a lot of features that will secure your applications. We have been using cloud services for the last 3 years and most of the services are running on AWS. In our condition we need a lot of security.
  • Web traffic filtering
  • Bot Control
  • Real-time visibility
  • Easy to monitor web traffic
  • Prevent against any type of attack, like SQL code injection
  • Easy to create the rules
  • Easy to filter the packet as per your requirement
  • Less documentation available for help in configuration and maintenance
  • AWS should work on their technical support
  • High price
If you have deployed your servers and application and have them running through the cloud, then you should choose the AWS WAF for security. This is very good cloud firewall which will protect your application and servers from any type of attacks. On the cloud, everyone can easily reach your server, so you need to add more security. AWS WAF provides you a lot of features, which will help you to protect your cloud servers and applications from external attacks.
Score 9 out of 10
Vetted Review
Verified User
Review Source
The WAF is being used by my department for our 2 main WEB portal protection as well as using it for Maintenance Window open/close.
  • The possibility for choosing a lot of predefined rules
  • The possibility to setup custom rules
  • Very good user interface
  • Not very cheap
We have a lot of custom rules, since our SW is highly customised and a lot of web requests require customized protection.
Saim Jamali | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Review Source
AWS WAF is basically implemented to secure the web applications. I have a positive experience using the AWS Web Application Firewall (WAF). It has many features to protect our applications and solutions. The good thing about AWS WAF is it has the most friendly APIs for developers to create firewall rules for the web application. That makes our applications secure.
  • AWS WAF has the most developer-friendly API to create firewall rules.
  • AWS WAF provides OWASP security controls, which reduces developers' burden (i.e., SQL injection and cross-site scripting).
  • AWS WAF has customizable web security rules. The user can even push the rules through the API available, which is the great feature and helped me a lot.
  • It protects applications at layer 7 (HTTP) of the OSI model and not just layer 4 (TCP).
  • Need to enhance OWASP standards.
  • We are limited to five rate-based rules per AWS account.
AWS WAF is perhaps one of the best web application firewalls out there to date. Thankfully we have had no issues and we have been commended for using reputable vendors like AWS for security and privacy matters as part of our GDPR and ISO certifications. I would suggest that prospective customers use the CloudFormation templates provided by Amazon for creating the WAF.
Very comprehensive support is available. The user community also available to help with AWS WAF. The vendor that helped us purchase this service was very cooperative and helped us at every point, especially at the time of deployment. Since then, we take lot of help from its different communities. The user support is an other key reason to select AWS WAF.
Score 9 out of 10
Vetted Review
Verified User
Review Source
We use AWS WAF in our whole organization to help us protect all workloads we deploy using AWS CloudFront and AWS API Gateway. The mail problems we cover are layer seven attacks, but we also create whitelists and blacklists to allow or deny specific traffic. We also use Managed Rules for AWS WAF, to quickly get started and protect our web application or APIs against common threats.
  • Great integration with AWS services.
  • Easy configuration management via API.
  • Reporting.
  • Log visualization.
AWS WAF is well suited for securing HTTP/HTTPS and API services deployed in AWS as it is easily integrated with services like CloudFront and API Gateway. AWS WAF can be used to to address some application security flaws such as the ones named by the Open Web Application Security Project (OWASP).
If you're intending to use AWS WAF, I would say that you absolutely should sign up for support. AWS Support is excellent and they can help you in a really good way to solve your issues.
maría jose gonzalez ortiz | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Review Source
AWS WAF is a really useful software when implemented at the departmental level. It allows the infrastructure of the applications that are being executed to be protected in a very simple way since the user can establish rules to stop the vulnerabilities that can cause a malfunction in such applications. This is why we have decided to implement it in the business applications development department to dismiss these vulnerabilities and thus be able to concentrate on the development of applications without that concern.
  • It allows custom rules to be established to stop attacks that may harm business applications.
  • Its cost is based only on what the user uses to establish rules that can protect applications from vulnerabilities.
  • The rules can be established by the user or those that the system already brings with it being able to be centralized to reuse them for the rest of the applications, which saves time.
  • The user can choose the traffic of their applications.
  • The cost depends on the number of rules assigned.
  • It deploys new rules fast and efficiently.
  • The documentation offered is somewhat confusing, so it would be ideal if it were much more direct and precise.
  • Your initial configuration may be confusing, so the best option is to use the rule templates provided by AWS.
  • Its configuration is not unified with AWS, so it must be done separately and it takes some time.
  • The number of rules to be established is somewhat limited.
AWS is ideal for implementation in scenarios where business applications are consuming more resources than they should. When AWS WAF is used it prevents this from happening and in this way applications tend to run as they should. It is ideal to establish custom rules and centralize them to protect different applications without having to re-create the same rules which helps save time, as well as allowing the usual attack patterns to be blocked, such as cross-site scripts and SQL injection.
Hanna Bedoya | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Review Source
We use AWS WAF in the Application Development department since it is useful to provide protection against the most common web attacks such as the injection of SQL code and site scripts, as well as to prevent these applications from consuming more resources than they should actually consume. For this, we develop custom rules that allow us to block such attacks and at the same time improve the visibility of web traffic.
  • Protect any application against the most common attacks.
  • Provides better visibility of web traffic.
  • It allows us to control the traffic in different ways in which it is enabled or blocked through the implementation of security rules developed personally according to our needs.
  • It is able to block common attacks such as SQL code injection.
  • It allows defining specific rules for applications, thus increasing web security as they are developed.
  • It is necessary to have knowledge about the software because otherwise inappropriate rules will be created.
  • Your configuration can be somewhat tedious.
  • Your support team takes a long time to answer the user's questions.
  • Its costs can be somewhat high, unlike other services since it is charged by the number of rules that are created.
AWS WAF is highly appropriate to interrupt or prevent cyber attacks because when implementing rules, whether they are specific or centralized, so any application that has these vulnerabilities is protected.

Implementing managed rules creates greater security to protect both API and applications.

If implemented along with other AWS tools, the security is much better, so if you want to protect applications against more specific attacks, it is ideal to integrate with Amazon CloudFront, which is a great benefit because it warns when thresholds are exceeded or specific attacks occur.

AWS WAF is ideal to avoid common web attacks. For more specific attacks and scenarios, I don't recommend this.
Score 9 out of 10
Vetted Review
Verified User
Review Source
We were using WAF to protect our web application from cyber attacks by filtering the requests access to our web app. We created various rules and access control lists for blocking all the unwanted threats like SQL injections.
  • The deployment was pretty easy on the AWS platform
  • The cost of using AWF WAF is pretty low as you only have to pay for the rules that you are assigning and also, you can chose the traffic that you need for your application
  • The technical support is great, they are very good in understanding your problem and really helpful in providing the best solution
  • There is nothing much to dislike about this product
It is a pretty useful product if your web application is deployed on Amazon Web Service platform, else it could be a little complicated and pricey. It's useful if you want to lay down your own rules for security and traffic management of your web app. Having AWS WAF can assure you that the application that you are creating have integrated security features which can be maintained easily for future use. It does has some flaws, but it is backed up by Amazon which is doing a great job in everything that they are doing, so it surely has a great future.