Mitigating DDoS with AWS WAF Rate-Based Rules

AWS WAF provides protection against layer 7 attacks such as SQL injection and XSS. In addition, you can use rate-based rules to mitigate DDoS attacks.

Takahiro Iwasa

2023-01-09

4 min read

AWS WAF provides protection against layer 7 attacks such as SQL injection and XSS. In addition, you can use rate-based rules to mitigate DDoS attacks.

🔥 Caution

AWS WAF rate-based rules can help mitigate DDoS attacks, but they cannot provide complete protection. For more comprehensive protection, consider using AWS Shield Advanced.

Considerations:

The minimum rate that you can set is 100.
AWS WAF checks the rate of requests every 30 seconds, and counts requests for the prior 5 minutes each time. Therefore, it may take up to 30 seconds for AWS WAF to detect and restrict the traffic.
AWS WAF has a limit of 10,000 IP addresses for rate limiting. When more than 10,000 addresses exceed the rate, AWS WAF restricts those with the highest rates.

Building

The template below configures a rate limit of 100.

1
AWSTemplateFormatVersion: 2010-09-09
2
Description: AWS WAF Rate-based rule sample
3
Resources:
4
  S3Bucket:
5
    Type: AWS::S3::Bucket
6
    Properties:
7
      BucketName: !Sub aws-waf-rate-based-rule-sample-${AWS::AccountId}-${AWS::Region}
8
      BucketEncryption:
9
        ServerSideEncryptionConfiguration:
10
          - ServerSideEncryptionByDefault:
11
              SSEAlgorithm: AES256
12
      PublicAccessBlockConfiguration:
13
        BlockPublicAcls: TRUE
14
        BlockPublicPolicy: TRUE
15
        IgnorePublicAcls: TRUE
16
        RestrictPublicBuckets: TRUE
17

18
  S3BucketPolicy:
19
    Type: AWS::S3::BucketPolicy
20
    Properties:
21
      Bucket: !Ref S3Bucket
22
      PolicyDocument:
23
        Version: 2012-10-17
24
        Statement:
25
          - Effect: Allow
26
            Principal:
27
              Service: cloudfront.amazonaws.com
28
            Action: s3:GetObject
29
            Resource: !Sub arn:aws:s3:::${S3Bucket}/*
30
            Condition:
31
              StringEquals:
32
                "AWS:SourceArn": !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}
33

34
  # AWS::WAFv2::WebACL must be deployed in us-east-1.
35
  WAFv2WebACL:
36
    Type: AWS::WAFv2::WebACL
37
    Properties:
38
      Name: aws-waf-rate-based-rule-sample
39
      DefaultAction:
40
        Allow: { }
41
      VisibilityConfig:
42
        SampledRequestsEnabled: true
43
        CloudWatchMetricsEnabled: true
44
        MetricName: aws-waf-rate-based-rule-sample
45
      Scope: CLOUDFRONT
46
      Rules:
47
        - Name: rate-based-rule
48
          Priority: 0
49
          Action:
50
            Block: { }
51
          Statement:
52
            RateBasedStatement:
53
              Limit: 100
54
              AggregateKeyType: IP
55
          VisibilityConfig:
56
            SampledRequestsEnabled: true
57
            CloudWatchMetricsEnabled: true
58
            MetricName: rate-based-rule
59

60
  CloudFrontOriginAccessControl:
61
    Type: AWS::CloudFront::OriginAccessControl
62
    Properties:
63
      OriginAccessControlConfig:
64
        Name: aws-waf-rate-based-rule-sample
65
        OriginAccessControlOriginType: s3
66
        SigningBehavior: always
67
        SigningProtocol: sigv4
68

69
  CloudFrontDistribution:
70
    Type: AWS::CloudFront::Distribution
71
    DependsOn: CloudFrontOriginAccessControl
72
    Properties:
73
      DistributionConfig:
74
        Origins:
75
          - Id: !GetAtt S3Bucket.DomainName
76
            DomainName: !GetAtt S3Bucket.DomainName
77
            OriginAccessControlId: !Ref CloudFrontOriginAccessControl
78
            S3OriginConfig:
79
              OriginAccessIdentity: ''
80
        DefaultCacheBehavior:
81
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
82
          TargetOriginId: !GetAtt S3Bucket.DomainName
83
          ViewerProtocolPolicy: allow-all
84
        Enabled: true
85
        ViewerCertificate:
86
          CloudFrontDefaultCertificate: true
87
          MinimumProtocolVersion: TLSv1
88
        WebACLId: !GetAtt WAFv2WebACL.Arn
89
        DefaultRootObject: index.html

Deploy the stack:

aws cloudformation deploy \
  --region us-east-1 \
  --stack-name aws-waf-rate-based-rule-sample \
  --template-file template.yaml

❗ Important

AWS WAFv2 web ACL rules containing Scope: CLOUDFRONT must be deployed in the us-east-1 region.

Upload a sample index.html to the S3 bucket:

echo '<html><body>Hello World!</body></html>' > index.html
aws s3 cp index.html s3://aws-waf-rate-based-rule-sample-<ACCOUNT_ID>-us-east-1

Testing

Since the AWS WAF rate-checking interval is 30 seconds, send requests every second for 130 seconds or longer. Requests exceeding the configured limit will be blocked with a 403 Forbidden response.

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

AWS WAF checks the rate of requests every 30 seconds, and counts requests for the prior five minutes each time.

for i in `seq 1 130`; do
  echo "Request: $i"
  curl https://<CLOUDFRONT_DOMAIN>/
  echo "\n"
  sleep 1
done

Example blocked response:

1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
3
<TITLE>ERROR: The request could not be satisfied</TITLE>
4
</HEAD><BODY>
5
<H1>403 ERROR</H1>
6
<H2>The request could not be satisfied.</H2>
7
<HR noshade size="1px">
8
Request blocked.
9
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
10
<BR clear="all">
11
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
12
<BR clear="all">
13
<HR noshade size="1px">
14
<PRE>
15
Generated by cloudfront (CloudFront)
16
Request ID: xxxxxxxxxxxxxxxxxxxx
17
</PRE>
18
<ADDRESS>
19
</ADDRESS>
20
</BODY></HTML>

Cleaning Up

Remove the resources provisioned by this example with:

aws s3 rm --recursive s3://aws-waf-rate-based-rule-sample-<ACCOUNT_ID>-us-east-1
aws cloudformation delete-stack \
  --region us-east-1 \
  --stack-name aws-waf-rate-based-rule-sample

Conclusion

Deploying a CloudFront distribution behind a WAF rate-based rule with a limit of 100 requests confirmed that traffic exceeding the threshold gets blocked with a 403 response. The 30-second evaluation window is the detail most likely to cause confusion when testing this rule: a burst of requests well over the limit can still pass for the first half-minute, which looks like the rule isn’t working when it’s actually just evaluating on its own schedule. That built-in latency, along with the 10,000 IP cap on rate limiting, is exactly why the caution at the top frames this as DDoS mitigation rather than DDoS prevention — for anything beyond blunting a single source hammering an endpoint, this rule is meant to complement AWS Shield Advanced, not replace it.

Back to posts