Rules, Rule Groups, and Web ACLs

AWS WAF organizes protection into three layers: rules, rule groups, and a web ACL. A rule is a single condition and action; a rule group bundles related rules; a web ACL is the deployable container that you attach to a resource and that ties everything together.

A rule combines a match statement (such as a string match on the URI) with an action (allow, block, count, CAPTCHA). Rules can also combine statements with AND, OR, and NOT logic, letting you express conditions like block this path unless the request comes from a trusted IP set.

A rule group is a reusable collection of rules you can attach to multiple web ACLs. Groups can be AWS managed, sold by vendors in the Marketplace, or customer managed. Reuse keeps policy consistent across many applications without duplicating individual rules.

A web ACL (access control list) is the top-level object you associate with a CloudFront distribution, ALB, or API Gateway. It contains an ordered list of rules and rule groups plus a default action. Only resources linked to a web ACL are actually protected by WAF.

Rules in a web ACL are evaluated in priority order, lowest number first. The first rule whose action terminates evaluation (block or allow) wins. Count actions do not terminate, so evaluation continues. Getting priority right is critical: a broad block early can shadow more specific rules.

If no rule reaches a terminating action, the web ACL applies its default action (allow or block). Each web ACL also has a complexity budget measured in WCUs (WAF Capacity Units), default maximum 1,500. Complex rules and large rule groups consume more WCUs; exceeding the budget means simplifying rules or requesting an increase, so plan capacity when combining many managed groups.

A web ACL has a scope: CLOUDFRONT (global, created in us-east-1) or REGIONAL (for ALB, API Gateway, AppSync in a specific Region). A regional web ACL cannot protect CloudFront, so you must create the web ACL in the correct scope from the start.

Rules can add labels to a request that later rules inspect. A managed rule group might label a request as a likely bot, and your custom rule can then decide whether to block or challenge it. Labels let managed and custom logic cooperate without duplicating detection.

Within a managed rule group you can override individual rules to count instead of block, or exclude them entirely. This is how you tune a managed group that causes false positives without abandoning the whole group, preserving the rest of its protection.

Managed rule groups are versioned by AWS so updates do not silently change behavior. You can pin a version or follow the latest. Customer-managed rule groups let your security team centralize policy and share it across application teams as a single maintained unit.

A typical web ACL chains an IP allow-list, one or two AWS managed groups (core rule set, known bad inputs), a rate-based rule, and a few custom rules, ending in a default allow. Understanding how these layers and priorities interact is core to deploying WAF effectively.

Test your grasp of WAF structure.

WAF nests rules inside rule groups inside a web ACL that you attach to a resource. Rules combine match statements and actions; rule groups are reusable and can be AWS managed, Marketplace, or custom. Web ACLs evaluate rules in priority order with a default action, are bounded by WCUs, and have a CLOUDFRONT or REGIONAL scope. Labels and per-rule overrides let managed and custom logic cooperate.