Managed Rules and Rate Limiting

AWS Managed Rules are pre-built rule groups maintained by the AWS threat research team. They protect against common, evolving threats so you do not have to write and update every signature yourself. Most WAF deployments start with one or two managed groups as a strong baseline.

The Core Rule Set (CRS) is the foundational managed group, addressing a broad range of OWASP Top 10 risks. It blocks high-risk request patterns and serves as the default starting point for general web application protection before you add more targeted groups.

AWS offers focused groups such as Known Bad Inputs, SQL Database (anti-SQL-injection), Linux and POSIX operating system rules, PHP, and WordPress. You add the ones matching your stack so the rules are relevant and you avoid wasting WCUs on irrelevant signatures.

AWS WAF Bot Control is a managed group that identifies and manages bot traffic, labeling requests as verified bots, suspected bots, or scrapers. It lets you allow good bots like search crawlers while blocking or challenging malicious automation, addressing threats that look like ordinary requests.

Specialized managed groups like Account Takeover Prevention (ATP) and Account Creation Fraud Prevention (ACFP) watch login and signup flows for credential stuffing and fake-account abuse. They inspect submitted credentials against known compromised sets to stop fraud at the edge.

Managed rules occasionally block legitimate requests. Rather than removing a whole group, set the offending rule to count or exclude it using a per-rule override. Run new managed groups in count mode first, review the logs, then switch to block once you confirm low false positives.

A rate-based rule counts requests from a source over a rolling time window (default five minutes) and triggers its action once a threshold is exceeded. This throttles brute-force logins, scraping, and application-layer floods that would slip past content-matching rules.

Rate-based rules can aggregate by IP address, by forwarded IP (for clients behind proxies), or by custom keys like a header or query parameter. Aggregating by a session token or API key, rather than IP, can more precisely throttle a single abusive client behind shared NAT.

You can attach a scope-down statement to a rate-based rule so it only counts requests matching a condition, such as POSTs to the login path. This focuses rate limiting on sensitive endpoints instead of throttling all traffic, reducing impact on normal users.

Rate-based rules are a primary defense against application-layer (Layer 7) DDoS, which Shield Standard does not fully cover. When floods consist of many valid-looking requests, rate limiting per source caps the damage. This complements Shield Advanced, which can also act on WAF rules during attacks.

A solid WAF baseline combines the Core Rule Set, a stack-specific group like SQL Database, Bot Control if needed, and a rate-based rule on login endpoints, all tuned with count-first testing. This gives broad coverage without crippling false positives or exhausting WCUs.

Apply rate-limiting knowledge.

AWS Managed Rules provide maintained baselines: the Core Rule Set, targeted groups (SQL Database, Known Bad Inputs, WordPress), Bot Control, and fraud groups like ATP and ACFP. Tune false positives with count mode and per-rule overrides. Rate-based rules throttle sources over a time window, aggregate by IP or custom keys, and use scope-down statements to mitigate Layer 7 DDoS and brute force.