Best WAF for Serverless
Protect your serverless applications on AWS Lambda, Google Cloud Functions, and Azure Functions. Compare cloud-native WAFs, edge protection, and API security platforms for serverless architectures.
Serverless architectures present unique WAF challenges. There's no traditional server to install a WAF on, traffic patterns are highly variable, and applications are often composed of dozens of functions behind API gateways. Traditional WAF deployment models don't map cleanly to serverless.
The good news is that serverless platforms are typically fronted by managed services (API Gateway, Cloud Endpoints, Azure API Management) that integrate with cloud-native WAFs. Combined with edge WAFs like Cloudflare or Fastly, you can build comprehensive protection without managing any WAF infrastructure.
This guide compares WAF solutions that work with serverless architectures across AWS Lambda, Google Cloud Functions, Azure Functions, and edge compute platforms.
Top WAF Providers for Serverless
AWS Web Application Firewall
Best for LambdaAWS WAF is the natural choice for Lambda-based serverless applications. It integrates natively with API Gateway (REST APIs), CloudFront, AppSync, and App Runner, the services that front most Lambda functions. Managed rule groups cover the OWASP Top 10, bot protection, and account fraud prevention. Pricing is usage-based ($0.60 per million requests) on top of a modest fixed monthly fee ($5.00 per web ACL plus $1.00 per rule per month), so cost still scales largely with traffic. Note that AWS WAF attaches to API Gateway REST APIs but not to the cheaper HTTP APIs (API Gateway v2), which are common in serverless stacks.
Key Benefits:
- Native API Gateway (REST), CloudFront, and AppSync integration
- Usage-based per-request pricing on top of a small fixed web ACL/rule fee
- Managed rule groups for common threats
- Bot Control and Fraud Prevention add-ons
Cloudflare Web Application Firewall
Multi-Cloud EdgeCloudflare provides edge WAF protection for any serverless backend regardless of cloud provider. The free tier includes basic WAF and DDoS protection. For serverless applications exposed via custom domains, Cloudflare is the easiest way to add WAF protection with zero infrastructure management, and Cloudflare Workers can run native rules and custom security logic at the edge.
Key Benefits:
- Works with any serverless provider
- Free tier with WAF and DDoS
- Zero infrastructure to manage
- Global edge network for performance
Google Cloud Armor
Best for GCP ServerlessGoogle Cloud Armor protects Cloud Functions and Cloud Run when exposed via a global external Application Load Balancer. Adaptive Protection provides ML-based DDoS defense, and preconfigured WAF rules (based on the OWASP Core Rule Set) cover the OWASP Top 10. Traffic stays within GCP via a serverless network endpoint group (NEG) and external load balancer, so no third-party routing is needed, though that load-balancer front end must be provisioned; it is not automatic.
Key Benefits:
- Protects Cloud Functions and Cloud Run
- ML-powered Adaptive Protection
- Native GCP load balancer integration (via serverless NEG)
- Preconfigured OWASP rules
Azure Web Application Firewall
Best for AzureAzure WAF is the native path for Azure Functions, which are typically fronted by Azure API Management and exposed through Azure Front Door or Application Gateway. Attaching a WAF policy to Front Door (global edge) or Application Gateway (regional) protects the function's HTTP endpoints with the Microsoft Default Rule Set (baselined on the OWASP Core Rule Set), managed bot rules, and custom and rate-limit rules. On Front Door Standard and Premium the WAF is bundled into the tier price rather than billed per policy.
Key Benefits:
- Protects Azure Functions via Front Door or Application Gateway
- Microsoft Default Rule Set (based on OWASP CRS)
- Managed bot protection and rate limiting
- WAF bundled into Front Door Standard/Premium tiers
Fastly Next-Gen WAF (Signal Sciences)
Edge ComputeFastly Next-Gen WAF protects serverless applications at the edge with SmartParse technology that reduces false positives. Its edge compute platform, Fastly Compute (formerly Compute@Edge), can also run custom security logic alongside your serverless application, blurring the line between WAF and application security.
Key Benefits:
- SmartParse for low false positives
- Edge compute for custom security logic
- Real-time attack visibility
- Serverless-native deployment
What to Look For in a WAF for Serverless
Key factors for serverless WAF selection:
- API Gateway Integration - Most serverless functions sit behind an API gateway. Your WAF must integrate with API Gateway (AWS), Cloud Endpoints (GCP), or API Management (Azure) without adding architectural complexity. Note that AWS WAF attaches to API Gateway REST APIs but not to HTTP APIs (API Gateway v2).
- Pay-Per-Request Pricing - Serverless billing is usage-based. Favor WAF pricing that scales with traffic; watch for fixed monthly components (for example, AWS WAF adds a $5/web ACL plus $1/rule monthly fee on top of per-request charges) that can dominate the bill for low-traffic functions.
- API-Specific Protection - Serverless applications are predominantly API-driven. Look for JSON/GraphQL inspection, schema validation, and API-aware rules beyond generic WAF protection.
- Cold Start Compatibility - Serverless functions have cold starts. Ensure your WAF doesn't add significant latency on top of cold start delays.
- Multi-Function Coverage - Serverless applications often consist of many functions. Your WAF should protect all functions behind a single policy without per-function configuration.
- Rate Limiting - Protect against function invocation abuse. Rate limiting at the WAF level prevents runaway costs from malicious traffic hitting your serverless functions.
Serverless Considerations
Serverless-specific WAF considerations:
- No Server to Install On - Traditional WAF modules (ModSecurity, F5 WAF for NGINX) require a server. Serverless WAF protection must happen at the edge, API gateway, or as a managed service.
- Cost Amplification - Without WAF protection, malicious traffic still invokes your functions and incurs costs. A WAF at the API gateway or edge level blocks bad traffic before it reaches your functions.
- Event Sources - WAFs protect HTTP-triggered functions. For event-driven functions (SQS, EventBridge, Pub/Sub), input validation must happen within the function code.
- Function URLs - AWS Lambda Function URLs and similar direct invocation endpoints bypass API Gateway and its WAF. Ensure all public traffic routes through your WAF-protected gateway.
- Edge Functions - Platforms like Cloudflare Workers, Fastly Compute, and Lambda@Edge run at the CDN edge. These can act as lightweight WAFs themselves or be protected by the platform's native WAF.
Frequently Asked Questions
Can I use ModSecurity with serverless?
Not directly, ModSecurity requires a web server to run on, which serverless architectures don't have. However, you can place an NGINX reverse proxy with OWASP ModSecurity in front of your API Gateway, though this partially defeats the purpose of serverless. Cloud-native WAFs (AWS WAF, Cloud Armor, Azure WAF) or edge WAFs (Cloudflare, Fastly) are better fits for serverless.
How do I protect AWS Lambda functions with a WAF?
Route Lambda traffic through API Gateway (REST API) or CloudFront, then attach AWS WAF to the API Gateway stage or CloudFront distribution. Note that AWS WAF cannot attach directly to API Gateway HTTP APIs (v2); use a REST API or front the endpoint with CloudFront. Avoid exposing Lambda via Function URLs without WAF protection, as these bypass API Gateway entirely.
How do I protect Azure Functions with a WAF?
Front your Azure Functions with Azure API Management or expose them through Azure Front Door or Application Gateway, then attach an Azure WAF policy. Front Door WAF protects at the global edge and, on the Standard and Premium tiers, bundles the WAF into the tier price; Application Gateway WAF protects regionally. Both use the Microsoft Default Rule Set, which is based on the OWASP Core Rule Set.
Will a WAF add latency to my serverless functions?
Cloud-native WAFs like AWS WAF add minimal latency (typically under 2ms) when integrated with API Gateway or CloudFront. Edge WAFs like Cloudflare may actually reduce latency through CDN caching. The latency overhead is negligible compared to typical cold start times.
How do I prevent cost overruns from attacks on serverless?
Deploy a WAF at the API Gateway or edge level to block malicious traffic before it invokes your functions. Additionally, set concurrency limits on your Lambda functions, use API Gateway throttling, and set up billing alerts. A WAF is your first line of defense against serverless cost attacks.