WAF Rule Types and Rule Groups
~8 min read
Managed rule groups, rate-based rules, and custom rules — three ways to define what WAF filters.
WAF Rule Types and Rule Groups is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •Managed Rule Groups: pre-built, AWS-maintained, cover common threat categories, zero rule-writing effort
- •Rate-based rules: block/count a source exceeding a request threshold, mitigates scraping/credential-stuffing
- •Custom rules: arbitrary match conditions for application-specific filtering needs
- •Most Web ACLs combine all three: managed groups as a baseline, rate-based rules for abuse patterns, custom rules for specific needs