How to Configure AWS WAF with Application Load Balancer

Open the AWS Console and navigate to WAF & Shield:

1. Sign into the AWS Console
2. Search for "WAF" in the services search bar
3. Select "AWS WAF" from the results

Create a new Web ACL to contain your firewall rules:

1. Click "Create web ACL"
2. Enter a name (e.g., "production-web-acl")
3. Select "Regional resources (ALB, API Gateway)" for resource type
4. Select your region
5. Click "Next"

Add managed rule groups for immediate protection:

1. Click "Add rules" > "Add managed rule groups"
2. Expand "AWS managed rule groups"
3. Enable "Core rule set" (protects against OWASP Top 10)
4. Enable "Known bad inputs" (blocks requests with known malicious patterns)
5. Enable "SQL database" if your app uses SQL
6. Click "Add rules"

Set what happens to requests that don't match any rules:

1. For "Default web ACL action for requests that don't match any rules", select "Allow"
2. This means only explicitly blocked traffic is denied
3. Click "Next"

Rules are evaluated in order. AWS processes them top to bottom:

1. Drag rules to set priority (highest priority at top)
2. Generally, put block rules before allow rules
3. Click "Next"

Attach the Web ACL to your Application Load Balancer:

1. Click "Add AWS resources"
2. Select "Application Load Balancer"
3. Check the box next to your ALB
4. Click "Add"
5. Click "Next" and then "Create web ACL"

Enable logging to monitor blocked requests:

1. Select your Web ACL
2. Go to the "Logging and metrics" tab
3. Click "Enable logging"
4. Choose a destination (CloudWatch Logs, S3, or Kinesis)
5. Click "Save"