AWS WAF - Blocking excessive requests from one IP address

Question

We are looking to enable AWS WAF in front of our Application Load Balancer. The aim would be to prevent a single IP address from flooding our application with excessive requests.

(1) Is there a way to implement this with WAF? When I look to adding the rule, it requires a IP set to apply the rule too - but we would like to implement it to all IP Addresses.

(2) Is there an easy way to find out the current number of requests per IP address in order to benchmark to decide what is classified as excessive and should be blocked?

Answer

It sounds like you are looking for a [rate-based rule](https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/aws-waf-rate-based-rules.html).

In addition to the guidance linked above, I recommend you take a look at this [blog post](https://aws.amazon.com/blogs/security/three-most-important-aws-waf-rate-based-rules/) which discusses rate-based rules in more detail, as well as how you can analyse your logs in order to find how many requests each client IP is sending you.

AWS WAF - Blocking excessive requests from one IP address

Relevant content