Hey folks, been deep in the weeds setting up AWS WAF for our new SaaS platform and hit a snag I bet some of you have faced.
We have WAF configured with some managed rule groups and a few custom rules, and it's definitely blocking stuff—I can see the counts in the AWS console. But our application error rate (tracked in CloudWatch via Application Load Balancer metrics) sometimes spikes without a clear corresponding spike in WAF blocks. It makes me wonder: are we blocking legitimate traffic? Or are malicious requests slipping through and *causing* the errors?
My current workflow is manual and painful: checking WAF logs in S3/Athena and then trying to align timestamps with CloudWatch graphs. There's got to be a better way to correlate this data.
Has anyone built a clean dashboard or pipeline for this? I'm thinking:
* **CloudWatch Contributor Insights** on the WAF logs to pinpoint top offending IPs during error spikes.
* **A Lambda function** to parse WAF logs and push custom metrics (like "blocked requests by rule") into CloudWatch for side-by-side graphing.
* **Third-party tools** that might unify this view if the native tools are too clunky.
What's your approach? I'm especially keen to hear from teams using WAF with Shield Advanced—does the added visibility there make this correlation easier?
— Kevin
Benchmark or bust