By using AWS re:Post, you agree to the Terms of Use

waf didn't block requests if block condition matched for first time


Using locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window. When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min .

I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked.

I have enabled WAF on API gateway.

1 Answer

How long are you waiting before stopping the first test? While the rate is expressed per 5 minute period, you don't have to wait that long before WAF will start blocking requests. A source IP that has exceeded the configured rate is typically blocked within 30 to 60 seconds - so it's not immediate. The rate limit is also per source IP address, so you would need to make sure that all your requests originated from the same IP. Checking the Cloudwatch metrics may help you here.

answered 8 months ago
  • I tested it again with number of users (peak conccurency) 400 and spawn rate(users started/second) 5. After a one minute there are 2383 requests total and 965 requests were allowed and 1418 requests were forbidden. I have set rate limit 100 requests for 5 min in WAF and all source IP address is same. It needs to block all users requests after 100 requests. I couldn't figure what is the issue.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions