Filter suspicious web requests carefully — AWS WAF

Your goal

Plan a web request filter that blocks abuse while letting real visitors through.

Why this matters

Your public app is receiving suspicious requests. You will choose where filtering belongs, test rules without surprising users, and keep application security checks in place.

Words you will use

A web ACL is a collection of request rules. A managed rule group provides maintained rules. Count mode records matches without blocking them. A false positive blocks harmless traffic.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Put the filter in the request path

A supported public web resource receives traffic before it reaches your app. You want rules that inspect those requests. Choose the right protection.

What can inspect matching web requests?

An AWS WAF web ACL associated with the supported resource.

AWS WAF applies web ACL rules to requests for supported resources. Choose the correct resource and scope, then confirm the traffic actually passes through it. A rule attached elsewhere cannot protect this path.

Requests pass through the intended inspection point.

Supported entry point → associated web ACL → app

2. Test before blocking

A new rule matches attack samples but also some legitimate search queries. Blocking every match immediately could break the search page. Choose a rollout.

What should you do first?

Use count mode, inspect matches, and tune with real examples.

Count mode helps you observe rule matches before enforcing blocks. Review false positives and expected attack patterns, then enable the intended action gradually with monitoring. Filtering needs ongoing tuning.

The rule has been checked against legitimate visitor behavior.

Count matches → inspect and tune → enforce and monitor

3. Keep checks inside the app

A filter catches some suspicious input. A teammate suggests removing authorization checks from the application because WAF is installed. Choose your response.

What should remain in the app?

Authorization, safe data handling, and other application defenses.

A web filter is one layer of defense. It does not know every business rule or replace safe queries, output handling, and access checks. Keep protecting the application even when a request passes the filter.

The app keeps its own security boundaries.

Request filter + secure app logic → complementary protection

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.