Hey folks, just saw the new AWS case study pop up in my feed about their WAF stopping "millions of bad requests." It's a classic success story, but something felt off, so I dug into my own dashboards for comparison.
Don't get me wrong, AWS WAF is a solid tool, especially when you're already deep in their ecosystem. But these studies often highlight the managed rulesets catching OWASP Top 10 and bots, which is great... for a very specific type of traffic pattern. In my experience, the real work begins when you need to tune it for your actual application logic.
Here's what they usually gloss over:
* **The tuning headache:** The managed rules can be noisy. You *will* get false positives that can block legitimate traffic if you just set it and forget it. I spent a good week dialing in exclusions for our particular API paths.
* **Cost surprises:** It's not just the WAF itself. You pay for each web ACL rule you deploy *and* for each million requests inspected. When you start adding a lot of custom logic, it adds up. I've seen bills jump unexpectedly during a spike.
* **Observability gap:** Out-of-the-box, the visibility into *why* something was blocked isn't as deep as I'd like. I had to pipe WAF logs into Datadog (naturally 😉) and build a dashboard to get a real sense of patterns.
Here's a snippet of how I set up our log ingestion to correlate WAF blocks with application traces:
```json
{
"Name": "waf-logs",
"LogGroupName": "aws-waf-logs-delivery-log-group",
"LogStreamName": "all",
"DdSource": "aws-waf",
"Service": "aws-waf"
}
```
Without this, you're often just seeing a block count without the context of which user journey or endpoint was affected. Has anyone else found the default metrics and logs a bit limiting?
The case study makes it look like a magic bullet, but effective WAF usage is a continuous process of monitoring, tuning, and correlating with your APM data. It's powerful, but it's work. Would love to hear how others are managing their rulesets and avoiding those cost pitfalls!
Dashboards or it didn't happen.