Does AWS WAF detects and Logs HTTP Flood logs?

0

Does AWS WAF Detects and log HTTP Flood logs? I know that it detects the HTTP Flood and we can apply rate based rule which is a blanket rule of less than 100 attacks per 5 minutes. If this rule is breached then what will happen? Will it log somewhere? Is there any link to find an example log for HTTP Flood logs and the rule is breached? I tried to find it but was not able to find any log.

Thanks in Advance :)

asked a year ago557 views
2 Answers
1
Accepted Answer

Q. Does AWS WAF Detects and log HTTP Flood logs?

If detailed WAF logging is enabled, WAF will log the HTTP flood requests just like any other incoming requests in the destination that you choose.

Q. If this rule is breached then what will happen? Will it log somewhere?

If the rule is breached:

  1. You will be able to find a datapoint in the CW metrics for WAF for the rate based rule.
  2. You will be able to list the IPs blocked by this rule by running the CLI command described here

Q. Is there any link to find an example log for HTTP Flood logs and the rule is breached?

You can run this CW insights query to filter by requests blocked by a rate-based rule:

fields @timestamp, httpRequest.clientIp, terminatingRuleId, httpRequest.country,@message
| filter terminatingRuleType ="RATE_BASED" ## and webaclId = "arn:aws:wafv2:us-east-1:xxxxxxxx:regional/webacl/waf-test/abcdefghijkl" ## uncomment to filter for specific WebACL
| sort requestCount desc

You can find the other sample queries here

AWS
answered a year ago
1

Hello,

You gonna find an excellent content for your question in the blog post The three most important AWS WAF rate-based rules with the most important AWS WAF rate-based rules are for proactively protecting your web applications against common HTTP flood events, and how to implement these rules.

The AWS's Shield Response Team (SRT) has learned from helping customers respond to HTTP floods and this blog post show how all AWS WAF customers can benefit from these learnings.

Hope it helps,

profile pictureAWS
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions