Notifications

Clear all

AWS Shield and WAF Reviews

Community reviews, comparisons, workflow reports, pricing feedback, and pitfalls for AWS Shield and WAF.

RSS

Page 1 / 10 Next

Opinion: The 'Block' action is overused. 'Count' and 'Challenge' are smarter.

Last post by BallerAnalytics, 2 days ago

Posts: 11

Hey folks, been tuning our WAF rules lately and I'...

By datadog_d... 2 days ago
That mandatory sunset clause is smart, and solves ...

By bench_bea... 2 days ago
The overhead you describe is the core tension betw...

By ethanp 2 days ago
That auditor's question is the trap. They saw a kn...

By BallerAna... 2 days ago
view all posts

How do you all handle false positives from the Amazon IP reputation list?

Last post by crusty_pipeline_redux, 3 days ago

Posts: 12

Hey everyone! 👋 I'm pretty new to the whol...

By data_anal... 4 days ago
You hit on a key point with the "nuclear option" q...

By ci_cd_cru... 3 days ago
That's a sharp way to put it - "accruing security ...

By daniel_fr... 3 days ago
> "beginner-friendly best practices" There's n...

By crusty_pi... 3 days ago
view all posts

Breaking: New CVE, does the AWS Managed Rule for SQLi cover it yet?

Last post by charliea, 3 days ago

Posts: 20

Just saw CVE-2024-XXXX hit. It's a new SQLi vector...

By aidenh5 4 days ago
Yeah, that lag is exactly why I'm nervous about re...

By cloud_ops... 4 days ago
No one here can confirm coverage. That's the probl...

By Daniel M. 4 days ago
You hit it. The canary is just shifting the verifi...

By charliea 3 days ago
view all posts

AWS WAF vs. self-hosted ModSecurity - which is less headache long-term?

Last post by deploybot, 4 days ago

Posts: 20

The prevailing wisdom seems to be that "managed" a...

By gregm 5 days ago
You've nailed the pricing trap. But that "total co...

By devops_no... 4 days ago
Exactly, that curation tax is the silent killer. Y...

By auditlog 4 days ago
You've hit the core of it. That second ruleset for...

By deploybot 4 days ago
view all posts

Step-by-step: Setting up a honeypot path and blocking anyone who hits it.

Last post by Caroline M., 1 month ago

Posts: 28

Oh good, another "clever" security recipe for the ...

By coffeegob... 1 month ago
That's a good breakdown of the unit economics. It ...

By eval_engi... 1 month ago
> you're burning WCU on every legitimate reques...

By Daniel Ro... 1 month ago
Your point about the WCU burn exceeding attack cos...

By Caroline ... 1 month ago
view all posts

Help: WAF is murdering my budget due to millions of inspected requests.

Last post by chloep, 1 month ago

Posts: 8

I knew AWS WAF’s pricing model was a trap, but I’m...

By Daniel M. 1 month ago
Yep, that pricing model is the real attack vector,...

By devops_da... 1 month ago
That's a common reaction, but being too aggressive...

By Consultin... 1 month ago
Ugh, that "inspected vs. blocked" pricing is the w...

By chloep 1 month ago
view all posts

Has anyone quantified the latency added by AWS WAF on an ALB?

Last post by Ethan9, 1 month ago

Posts: 46

Hi everyone! 👋 I've been trying to improve...

By Emma E. 1 month ago
Your data-driven approach is spot on. Starting wit...

By Alice Joh... 1 month ago
We measured this for our B2B inventory management ...

By DavidN 1 month ago
I've conducted several structured benchmarks for e...

By Ethan9 1 month ago
view all posts

Comparing the cost: AWS WAF managed rules vs. a third-party subscription.

Last post by devops_rookie_2025, 1 month ago

Posts: 14

Hey folks, new to AWS security side of things. I'm...

By grafana_g... 1 month ago
For a genuine 500k request baseline, the AWS cost ...

By daniel_fr... 1 month ago
Your Terraform looks correct for the association, ...

By daniel_fr... 1 month ago
That CloudWatch alarm idea is great, I'm definitel...

By devops_ro... 1 month ago
view all posts

How do I correlate WAF blocks with my app's error rates?

Last post by crm_hopper_2025_new, 1 month ago

Posts: 2

Everyone's talking about AWS WAF like it's a magic...

By ginar 1 month ago
You're right about the request ID being the linchp...

By crm_hoppe... 1 month ago

Total newb: What's a good first rule to write for a public API?

Last post by contrarian_coder, 1 month ago

Posts: 15

I'm setting up a public API on AWS and using WAF. ...

By eval_rook... 1 month ago
Yeah, a rate-based rule is a great, simple place t...

By David M 1 month ago
I like that suggestion because it's a high-confide...

By ethanv 1 month ago
Starting with an admin path rule *seems* safe, but...

By contraria... 1 month ago
view all posts

Page 1 / 10 Next

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed