Mitigating DDoS with AWS WAF Rate-Based Rules

Use AWS WAF rate-based rules to limit excessive requests and mitigate application-layer DDoS attacks.

Takahiro Iwasa

2023-01-09

4 min read

AWS WAF protects web applications from layer 7 attacks such as SQL injection and cross-site scripting (XSS). Its rate-based rules can also limit excessive requests and help mitigate application-layer DDoS attacks.

🔥 Caution

AWS WAF rate-based rules can help mitigate DDoS attacks, but they cannot provide complete protection. For more comprehensive protection, consider using AWS Shield Advanced.

As of January 2023, keep the following behavior and limits in mind:

The minimum configurable rate is 100 requests per five-minute period for each tracked IP address.
AWS WAF checks the rate of requests every 30 seconds, and counts requests for the prior 5 minutes each time. Therefore, it may take up to 30 seconds for AWS WAF to detect and restrict the traffic.
AWS WAF has a limit of 10,000 IP addresses for rate limiting. When more than 10,000 addresses exceed the rate, AWS WAF restricts those with the highest rates.

Configuration

The template below configures a rate limit of 100 requests per five-minute period for each source IP address.

1
AWSTemplateFormatVersion: 2010-09-09
2
Description: AWS WAF Rate-based rule sample
3
Resources:
4
  S3Bucket:
5
    Type: AWS::S3::Bucket
6
    Properties:
7
      BucketName: !Sub aws-waf-rate-based-rule-sample-${AWS::AccountId}-${AWS::Region}
8
      BucketEncryption:
9
        ServerSideEncryptionConfiguration:
10
          - ServerSideEncryptionByDefault:
11
              SSEAlgorithm: AES256
12
      PublicAccessBlockConfiguration:
13
        BlockPublicAcls: TRUE
14
        BlockPublicPolicy: TRUE
15
        IgnorePublicAcls: TRUE
16
        RestrictPublicBuckets: TRUE
17

18
  S3BucketPolicy:
19
    Type: AWS::S3::BucketPolicy
20
    Properties:
21
      Bucket: !Ref S3Bucket
22
      PolicyDocument:
23
        Version: 2012-10-17
24
        Statement:
25
          - Effect: Allow
26
            Principal:
27
              Service: cloudfront.amazonaws.com
28
            Action: s3:GetObject
29
            Resource: !Sub arn:aws:s3:::${S3Bucket}/*
30
            Condition:
31
              StringEquals:
32
                "AWS:SourceArn": !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}
33

34
  # AWS::WAFv2::WebACL must be deployed in us-east-1.
35
  WAFv2WebACL:
36
    Type: AWS::WAFv2::WebACL
37
    Properties:
38
      Name: aws-waf-rate-based-rule-sample
39
      DefaultAction:
40
        Allow: { }
41
      VisibilityConfig:
42
        SampledRequestsEnabled: true
43
        CloudWatchMetricsEnabled: true
44
        MetricName: aws-waf-rate-based-rule-sample
45
      Scope: CLOUDFRONT
46
      Rules:
47
        - Name: rate-based-rule
48
          Priority: 0
49
          Action:
50
            Block: { }
51
          Statement:
52
            RateBasedStatement:
53
              Limit: 100
54
              AggregateKeyType: IP
55
          VisibilityConfig:
56
            SampledRequestsEnabled: true
57
            CloudWatchMetricsEnabled: true
58
            MetricName: rate-based-rule
59

60
  CloudFrontOriginAccessControl:
61
    Type: AWS::CloudFront::OriginAccessControl
62
    Properties:
63
      OriginAccessControlConfig:
64
        Name: aws-waf-rate-based-rule-sample
65
        OriginAccessControlOriginType: s3
66
        SigningBehavior: always
67
        SigningProtocol: sigv4
68

69
  CloudFrontDistribution:
70
    Type: AWS::CloudFront::Distribution
71
    DependsOn: CloudFrontOriginAccessControl
72
    Properties:
73
      DistributionConfig:
74
        Origins:
75
          - Id: !GetAtt S3Bucket.DomainName
76
            DomainName: !GetAtt S3Bucket.DomainName
77
            OriginAccessControlId: !Ref CloudFrontOriginAccessControl
78
            S3OriginConfig:
79
              OriginAccessIdentity: ''
80
        DefaultCacheBehavior:
81
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
82
          TargetOriginId: !GetAtt S3Bucket.DomainName
83
          ViewerProtocolPolicy: allow-all
84
        Enabled: true
85
        ViewerCertificate:
86
          CloudFrontDefaultCertificate: true
87
          MinimumProtocolVersion: TLSv1
88
        WebACLId: !GetAtt WAFv2WebACL.Arn
89
        DefaultRootObject: index.html

Deploy the stack:

aws cloudformation deploy \
  --region us-east-1 \
  --stack-name aws-waf-rate-based-rule-sample \
  --template-file template.yaml

❗ Important

AWS WAFv2 web ACL rules containing Scope: CLOUDFRONT must be deployed in the us-east-1 region.

Upload a sample index.html to the S3 bucket:

echo '<html><body>Hello World!</body></html>' > index.html
aws s3 cp index.html s3://aws-waf-rate-based-rule-sample-<ACCOUNT_ID>-us-east-1

Testing

Because AWS WAF evaluates the request rate every 30 seconds, send one request per second for at least 130 seconds. After the configured limit is exceeded and evaluated, subsequent requests receive a 403 Forbidden response.

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

AWS WAF checks the rate of requests every 30 seconds, and counts requests for the prior five minutes each time.

for i in `seq 1 130`; do
  echo "Request: $i"
  curl https://<CLOUDFRONT_DOMAIN>/
  echo "\n"
  sleep 1
done

Example blocked response:

1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
3
<TITLE>ERROR: The request could not be satisfied</TITLE>
4
</HEAD><BODY>
5
<H1>403 ERROR</H1>
6
<H2>The request could not be satisfied.</H2>
7
<HR noshade size="1px">
8
Request blocked.
9
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
10
<BR clear="all">
11
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
12
<BR clear="all">
13
<HR noshade size="1px">
14
<PRE>
15
Generated by cloudfront (CloudFront)
16
Request ID: xxxxxxxxxxxxxxxxxxxx
17
</PRE>
18
<ADDRESS>
19
</ADDRESS>
20
</BODY></HTML>

Cleaning Up

Remove the resources provisioned by this example with:

aws s3 rm --recursive s3://aws-waf-rate-based-rule-sample-<ACCOUNT_ID>-us-east-1
aws cloudformation delete-stack \
  --region us-east-1 \
  --stack-name aws-waf-rate-based-rule-sample

Conclusion

The WAF rate-based rule blocks requests to the CloudFront distribution with a 403 response after a source IP exceeds the configured limit of 100 requests in five minutes.

The 30-second evaluation interval can cause confusion during testing. Requests can continue to pass until AWS WAF performs its next evaluation, even after the five-minute request count exceeds the configured limit.

The evaluation delay and the 10,000-IP tracking limit are why this is a mitigation rather than complete DDoS protection. Rate-based rules complement services such as AWS Shield Advanced; they do not replace them.

Back to posts