Does AWS WAF detects and Logs HTTP Flood logs?

Question

Does AWS WAF Detects and log HTTP Flood logs? I know that it detects the HTTP Flood and we can apply rate based rule which is a blanket rule of less than 100 attacks per 5 minutes. 
If this rule is breached then what will happen? Will it log somewhere?
Is there any link to find an example log for HTTP Flood logs and the rule is breached? I tried to find it but was not able to find any log.

Thanks in Advance :)

AWS-User-3413787 · Accepted Answer

**Q. Does AWS WAF Detects and log HTTP Flood logs?**

> If [detailed WAF logging](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) is enabled, WAF will log the HTTP flood requests just like any other incoming requests in the [destination](https://docs.aws.amazon.com/waf/latest/developerguide/logging-destinations.html) that you choose.

**Q. If this rule is breached then what will happen? Will it log somewhere?**

> If the rule is breached: 
> 1. You will be able to find a datapoint in the [CW metrics for WAF](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html) for the rate based rule.
> 2. You will be able to list the IPs blocked by this rule by running the CLI command described [here](https://docs.aws.amazon.com/waf/latest/developerguide/listing-managed-ips.html)

**Q. Is there any link to find an example log for HTTP Flood logs and the rule is breached?**

You can run this CW insights query to filter by requests blocked by a rate-based rule:

```
fields @timestamp, httpRequest.clientIp, terminatingRuleId, httpRequest.country,@message
| filter terminatingRuleType ="RATE_BASED" ## and webaclId = "arn:aws:wafv2:us-east-1:xxxxxxxx:regional/webacl/waf-test/abcdefghijkl" ## uncomment to filter for specific WebACL
| sort requestCount desc
```
You can find the other sample queries [here](https://repost.aws/knowledge-center/waf-analyze-logs-stored-cloudwatch-s3)

Ibrahim Cesar · Answer

Hello,

You gonna find an excellent content for your question in the blog post [The three most important AWS WAF rate-based rules](https://aws.amazon.com/blogs/security/three-most-important-aws-waf-rate-based-rules/) with the most important AWS WAF rate-based rules are for proactively protecting your web applications against common HTTP flood events, and how to implement these rules.

The AWS's Shield Response Team (SRT) has learned from helping customers respond to HTTP floods and this blog post show how all AWS WAF customers can benefit from these learnings.

Hope it helps,

Does AWS WAF detects and Logs HTTP Flood logs?

Relevant content