AWS WAF for API Protection

Overview

The Guard platform attaches an AWS WAFv2 Web ACL (regional scope) to the Amazon API Gateway stage that fronts the REST API. This adds a network edge control layer on top of application authentication and authorization.

Infrastructure for this Web ACL is defined in the primary CloudFormation template (ApiGatewayWebACL and ApiGatewayWebACLAssociation in the Guard backend stack).

Rate limiting

• A rate-based rule aggregates traffic per client IP with a 5,000 requests per 5-minute evaluation window limit (as configured in the stack template).

• In production stacks, matching traffic is configured with a Block action; in non-production stacks, the same rule uses a Count action so traffic is observed but not blocked by rate limiting alone.

Managed rule groups (AWS)

The Web ACL includes three AWS Managed Rules rule groups:

• AWSManagedRulesCommonRuleSet — broadly applicable protections against common web exploits.

• AWSManagedRulesKnownBadInputsRuleSet — known malicious request patterns.

• AWSManagedRulesSQLiRuleSet — SQL injection patterns.

Each managed group is attached with an override action of Count (request logging and metrics, not automatic block). A scope-down exclusion applies to URI paths ending in /file so legitimate file-oriented API usage is less likely to be disrupted while still benefiting from visibility.

The IP rate limit rule provides the primary blocking behavior in production; managed groups currently prioritize detection and tuning over hard blocking.

Observability

Each rule and the Web ACL publish AWS WAF sampled requests and CloudWatch metrics under dedicated metric names, supporting monitoring, alerting, and forensic review.

Operational note

Organizations that want stricter enforcement may evaluate moving selected managed rule groups from Count to Block after reviewing false-positive rates against their API traffic. Changes to WAF behavior are infrastructure changes and should follow your change-management process.