waf didn't block requests if block condition matched for first time

Question

Using locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window.  When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min .

I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked.

I have enabled WAF on API gateway.

Answer

How long are you waiting before stopping the first test? While the rate is expressed per 5 minute period, you don't have to wait that long before WAF will start blocking requests. A source IP that has exceeded the configured rate is typically blocked within 30 to 60 seconds - so it's not immediate. The rate limit is also per source IP address, so you would need to make sure that all your requests originated from the same IP.
Checking the Cloudwatch metrics may help you here.

waf didn't block requests if block condition matched for first time

Contenido relevante