waf

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS WAF

Overview

概述

Domain expertise for configuring AWS WAF, the web application firewall that filters HTTP and HTTPS traffic to CloudFront distributions, Application Load Balancers, API Gateway REST APIs, and AppSync GraphQL APIs. Covers web ACL creation and association, AWS Managed Rules, rate-based rules, match rules (IP set and geographic), Bot Control and the signal-forwarding workflows built on top of it, Fraud Control for logins and signups, AI and LLM crawler management, and the logging that every tuning workflow depends on.

This skill is a router. Each customer task maps to a procedure file under

references/

. Read the matching reference in full before acting, then follow its constraints and steps. The reference files are self-contained: each carries its own decision tables, constraints, procedure, and troubleshooting.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. A web ACL's scope is fixed at creation: a CloudFront web ACL must be created in

us-east-1

with

CLOUDFRONT

scope, while a regional web ACL (Application Load Balancer, API Gateway, AppSync) is created in the resource's Region with

REGIONAL

scope.

本技能专注于配置AWS WAF（一款用于过滤流向CloudFront分发、Application Load Balancers、API Gateway REST API和AppSync GraphQL API的HTTP及HTTPS流量的Web应用防火墙）。内容涵盖web ACL的创建与关联、AWS托管规则、基于速率的规则、匹配规则（IP集和地理匹配）、Bot Control及其之上构建的信号转发工作流、用于登录和注册场景的Fraud Control、AI与LLM爬虫管理，以及所有调优工作流依赖的日志记录。

本技能作为一个路由工具。每个客户任务都对应

references/

目录下的一个流程文件。在执行操作前，请完整阅读对应的参考资料，然后遵循其中的约束条件和步骤。参考文件是独立完整的：每个文件都包含自身的决策表、约束条件、操作流程和故障排除指南。

连接AWS MCP服务器时使用该服务器执行命令（沙箱执行、审计日志、可观测性）。否则回退到AWS CLI。web ACL的作用域在创建时即固定：CloudFront web ACL必须在

us-east-1

区域创建，且作用域为

CLOUDFRONT

；而区域型web ACL（用于Application Load Balancer、API Gateway、AppSync）则需在资源所在区域创建，作用域为

REGIONAL

。

Which WAF task do you need?

您需要执行哪项WAF任务？

Goal	Reference
Create a web ACL and attach it to a resource	creating a web ACL and associating it with a resource
Set up logging and sampling before tuning anything	setting up logging and request sampling
Add AWS Managed Rules and tune false positives	adding managed rules and tuning with count mode
Throttle HTTP floods and brute force	adding rate-based rules
Allow or block by IP range or country	using ip sets and geographic match rules
Detect and control bots (the on-ramp)	protecting against bots with bot control
Collapse bot labels into one confidence signal	turning bot control labels into a confidence signal
Forward all signals to the origin with one rule	forwarding signals with dynamic label interpolation
Decide what the app does with the forwarded signal	adaptive mitigation playbook for forwarded signals
Stop attackers from spoofing forwarded headers	stripping inbound waf headers before trusting them
Recover the real client IP behind a CDN	recovering the real client ip behind a cdn
Protect logins and signups from fraud	protecting logins and signups with fraud control
See and manage AI and LLM crawler traffic	seeing and managing ai crawler traffic

目标	参考资料
创建web ACL并关联至资源	创建web ACL并关联至资源
在进行任何调优前设置日志记录和采样	设置日志记录和请求采样
添加AWS托管规则并调优误报	添加托管规则并使用计数模式调优
抑制HTTP洪水和暴力攻击	添加基于速率的规则
按IP范围或国家/地区允许或阻止流量	使用IP集和地理匹配规则
检测并管控Bot（入门操作）	通过Bot Control防护Bot攻击
将Bot标签合并为单一可信度信号	将Bot Control标签转换为可信度信号
通过一条规则将所有信号转发至源站	通过动态标签插值转发信号
确定应用如何处理转发的信号	转发信号的自适应缓解手册
阻止攻击者伪造转发标头	在信任转发标头前剥离入站WAF标头
恢复CDN后的真实客户端IP	恢复CDN后的真实客户端IP
保护登录和注册免受欺诈	通过Fraud Control防护登录和注册场景
查看并管理AI和LLM爬虫流量	查看并管理AI爬虫流量

Routing notes

路由说明

Logging comes before tuning. Every Count-mode tuning workflow assumes logging and request sampling are on. If the customer has not set up logging, run that reference first; otherwise Count-mode tuning has nothing to read.
Web ACL scope is fixed at creation. A CloudFront web ACL is
```
CLOUDFRONT
```
scope in
```
us-east-1
```
; a regional resource needs a
```
REGIONAL
```
web ACL in its own Region. Scope cannot be changed later, so the creating reference settles it before anything is built.
Bot Control is a chain, not one task. Protecting against bots is the on-ramp (turn on, choose Common vs Targeted, observe). Turning labels into a confidence signal, forwarding that signal, and deciding what the application does with it are three separate references that build on it in that order. The header-stripping reference is the mandatory safety companion whenever a signal is forwarded to the origin.
Common vs Targeted is not a soft choice. Common only catches self-identifying bots and known-bad IPs. For login, checkout, or any high-value endpoint facing evasive bots, Targeted with the application integration SDK is required. The bots reference pushes Targeted for real bot threats rather than presenting it as optional.
Rate limiting vs Fraud Control. Rate-based rules blunt volumetric HTTP floods. Credential stuffing and fake-account creation are account-based abuse that rate limiting misses; those go to the Fraud Control reference (ATP and ACFP), not the rate-based reference.
Forwarded headers need the strip rule. Any time the customer forwards a signal or the client IP to the origin in
```
x-amzn-waf-*
```
headers, the inbound-header-stripping reference is required to prevent spoofing. The confidence-signal, interpolation, and client-IP references all point at it.
What lives in other skills. L3/L4 DDoS protection and Shield cost-protection credits are the shieldadvanced skill. Multi-account WAF rollout is the firewallmanager skill. CloudFront and Application Load Balancer configuration are their own skills. This skill builds the WAF rules; it does not configure the resources it protects.

日志记录优先于调优。所有计数模式调优工作流都假设已开启日志记录和请求采样。如果客户尚未设置日志记录，请先执行对应的参考流程；否则计数模式调优将没有数据可分析。
web ACL作用域创建后不可更改。CloudFront web ACL的作用域为
```
CLOUDFRONT
```
，需在
```
us-east-1
```
区域创建；区域型资源需要在其所在区域创建作用域为
```
REGIONAL
```
的web ACL。作用域创建后无法修改，因此创建流程会在构建任何资源前确定作用域。
Bot Control是一个流程链，而非单一任务。防护Bot攻击是入门操作（开启服务、选择通用版或定向版、观测流量）。将标签转换为可信度信号、转发该信号以及确定应用如何处理信号是三个独立的参考流程，需按顺序逐步构建。当信号被转发至源站时，标头剥离流程是必不可少的安全配套操作。
通用版与定向版并非随意选择。通用版仅能识别自标识Bot和已知恶意IP。对于登录、结账或任何面临规避性Bot攻击的高价值端点，必须使用定向版及应用集成SDK。Bot防护参考流程会针对真实Bot威胁推荐使用定向版，而非将其作为可选选项。
速率限制与Fraud Control的区别。基于速率的规则可缓解大容量HTTP洪水攻击。凭证填充和虚假账户创建属于基于账户的滥用行为，速率限制无法覆盖；此类场景需使用Fraud Control参考流程（ATP和ACFP），而非基于速率的规则流程。
转发标头需要剥离规则。每当客户将信号或客户端IP通过
```
x-amzn-waf-*
```
标头转发至源站时，必须执行入站标头剥离流程以防止伪造。可信度信号、动态插值和客户端IP相关的参考流程均会指向该操作。
其他技能的覆盖范围。L3/L4 DDoS防护和Shield成本保护额度属于shieldadvanced技能。多账户WAF部署属于firewallmanager技能。CloudFront和Application Load Balancer配置有各自对应的技能。本技能负责构建WAF规则，不负责配置其防护的资源。

Security Considerations

安全注意事项

AWS WAF is itself a security control, so misconfiguration directly weakens an application's defenses. Apply these across every reference:

Least-privilege IAM. You MUST grant only the specific

wafv2:

actions a task needs (for example

wafv2:CreateWebACL

wafv2:GetWebACL

wafv2:UpdateWebACL

wafv2:AssociateWebACL

wafv2:PutLoggingConfiguration

) rather than

wafv2:*

or the

AWSWAFFullAccess

managed policy.

Ephemeral credentials. You MUST use IAM roles with temporary credentials (such as an EC2 instance profile, SSO session, or
```
aws sts assume-role
```
) rather than long-lived IAM user access keys when running these WAF CLI commands.
Monitor configuration changes. You SHOULD enable AWS CloudTrail on
```
wafv2
```
management events and set CloudWatch alarms on critical web ACL configuration changes (such as
```
DeleteWebACL
```
and
```
UpdateWebACL
```
rule removals) and on the web ACL's
```
BlockedRequests
```
and
```
CountedRequests
```
metrics, so rule changes and sudden spikes in blocked or counted traffic are detected.
Misconfiguration opens access. A web ACL that is created but never associated, or one whose default action is left at
```
Allow
```
with no enforcing rules, filters nothing. You MUST confirm the web ACL is associated and that its posture matches the intended default (block vs allow) before reporting setup complete.
Protect log destinations. Logs can capture credentials and session data. You MUST redact sensitive fields (such as the
```
authorization
```
header and
```
cookie
```
) and MUST enable encryption at rest on the log destination (CloudWatch Logs, Amazon S3, or Amazon Data Firehose).
Header-spoofing risk. Any
```
x-amzn-waf-*
```
signal forwarded to the origin can be forged inbound. You MUST add the inbound-header-stripping rule whenever a signal or client IP is forwarded (see stripping-inbound-waf-headers-before-trusting-them).

AWS WAF本身是一项安全控制措施，配置错误会直接削弱应用的防御能力。所有参考流程均需遵循以下要求：

最小权限IAM。必须仅授予任务所需的特定

wafv2:

操作权限（例如

wafv2:CreateWebACL

、

wafv2:GetWebACL

、

wafv2:UpdateWebACL

、

wafv2:AssociateWebACL

、

wafv2:PutLoggingConfiguration

），而非

wafv2:*

或

AWSWAFFullAccess

托管策略。

临时凭证。执行这些WAF CLI命令时，必须使用带有临时凭证的IAM角色（例如EC2实例配置文件、SSO会话或
```
aws sts assume-role
```
），而非长期有效的IAM用户访问密钥。
监控配置变更。应针对
```
wafv2
```
管理事件启用AWS CloudTrail，并针对关键web ACL配置变更（例如
```
DeleteWebACL
```
和
```
UpdateWebACL
```
规则移除）以及web ACL的
```
BlockedRequests
```
和
```
CountedRequests
```
指标设置CloudWatch告警，以便及时检测规则变更和被阻止/计数流量的突然激增。
配置错误会导致访问权限开放。已创建但未关联的web ACL，或默认动作为
```
Allow
```
且无强制规则的web ACL，无法过滤任何流量。在报告设置完成前，必须确认web ACL已关联，且其默认策略（阻止/允许）符合预期。
保护日志目标。日志可能包含凭证和会话数据。必须编辑敏感字段（例如
```
authorization
```
标头和
```
cookie
```
），并在日志目标（CloudWatch Logs、Amazon S3或Amazon Data Firehose）上启用静态加密。
标头伪造风险。任何转发至源站的
```
x-amzn-waf-*
```
信号都可能被伪造。每当转发信号或客户端IP时，必须添加入站标头剥离规则（请参考“在信任转发标头前剥离入站WAF标头”流程）。

waf

Original

Translation

AWS WAF

AWS WAF

Overview

概述

Which WAF task do you need?

您需要执行哪项WAF任务？

Routing notes

路由说明

Security Considerations

安全注意事项

Additional Resources

额外资源