WAF Rule Types and Rule Groups

AWS Managed Rule Groups are pre-built, continuously updated collections of rules maintained by AWS (and AWS Marketplace vendors) covering common threat categories — a 'Core rule set' covering general web application vulnerabilities, a 'SQL database' rule group specifically targeting SQL injection patterns, an 'IP reputation' rule group blocking known-malicious IP ranges, and others. These require no rule-writing effort and stay current as new attack patterns emerge.

Rate-based rules track the number of requests from a single IP address (or other configurable aggregation key) over a rolling 5-minute window, automatically blocking (or counting) that source once it exceeds a threshold you define — the standard tool for mitigating credential-stuffing, scraping, and brute-force attempts that don't necessarily match any specific malicious content pattern, just an abnormally high request volume from one source.

Custom rules let you define arbitrary match conditions — specific header values, query string patterns, geographic origin (blocking or allowing by country), or combinations of conditions — for application-specific filtering needs that neither managed rule groups nor simple rate limiting would catch, at the cost of needing to write, test, and maintain that rule logic yourself.