AWS Web Application Firewall AWS Current

How to Configure AWS WAF with Application Load Balancer

Learn how to protect your AWS applications by attaching AWS WAF to an Application Load Balancer with managed rule groups.

30-45 minutes intermediate 7 steps
Last updated: Jul 18, 2026

AWS WAF integrates natively with Application Load Balancer (ALB) to protect your web applications from common exploits and attacks.

This guide covers creating a Web ACL, attaching it to your ALB, and configuring managed rule groups for comprehensive protection.

Prerequisites

  • An AWS account with appropriate IAM permissions
  • An existing Application Load Balancer
  • Basic familiarity with AWS Console

Step-by-Step Guide

1

Navigate to AWS WAF Console

Open the AWS Console and navigate to AWS WAF:

  1. Sign into the AWS Console
  2. Search for "WAF" in the services search bar
  3. Select "AWS WAF" from the results

The standard console opens at https://console.aws.amazon.com/wafv2/homev2 and uses the "web ACL" terminology this guide follows. AWS is also rolling out a new console experience at https://console.aws.amazon.com/wafv2-pro that renames the object to a "protection pack (web ACL)" and restructures the creation wizard around App category, Traffic source, and protection levels (Recommended, Essentials, You build it). If you land in the new experience, the concepts map directly, but some labels and the wizard flow differ from the steps below.

Tip: Make sure you're in the correct AWS region where your ALB is deployed.
2

Create a Web ACL

Create a new Web ACL to contain your firewall rules:

  1. Click "Create web ACL"
  2. Enter a name (e.g., "production-web-acl")
  3. Under "Resource type", select "Regional resources" (this category covers ALB, API Gateway, and other regional resources; the alternative is "Amazon CloudFront distributions")
  4. Select your region
  5. Click "Next"
3

Add AWS Managed Rules

Add managed rule groups for immediate protection:

  1. Click "Add rules" > "Add managed rule groups"
  2. Expand "AWS managed rule groups"
  3. Enable "Core rule set" (protects against OWASP Top 10)
  4. Enable "Known bad inputs" (blocks requests with known malicious patterns)
  5. Enable "SQL database" if your app uses SQL
  6. Click "Add rules"
Tip: Start with these three rule groups; they provide broad protection with relatively few false positives. AWS recommends first deploying new managed rule groups in Count mode, then testing and tuning against your production traffic before switching to Block, so you can identify false positives without blocking legitimate users. To do this, choose "Edit" on the rule group and set the rule action override to "Count", then switch it back to the default (Block) once you are confident.
Warning: Managed rule groups have associated costs. Review pricing at https://aws.amazon.com/waf/pricing/
4

Configure Default Action

Set what happens to requests that don't match any rules:

  1. For "Default web ACL action for requests that don't match any rules", select "Allow"
  2. This means only explicitly blocked traffic is denied
  3. Click "Next"
5

Set Rule Priority

Rules are evaluated in order. AWS processes them top to bottom:

  1. Drag rules to set priority (highest priority at top)
  2. Generally, put block rules before allow rules
  3. Click "Next"
6

Associate ALB Resources

Attach the Web ACL to your Application Load Balancer:

  1. Click "Add AWS resources"
  2. Select "Application Load Balancer"
  3. Check the box next to your ALB
  4. Click "Add"
  5. Click "Next" and then "Create web ACL"

Note: When you associate an Application Load Balancer with a web ACL, AWS WAF automatically enables resource-level DDoS protection for that ALB.

7

Enable Logging (Recommended)

Enable logging to monitor blocked requests:

  1. Select your Web ACL
  2. Go to the "Logging and metrics" tab
  3. Click "Enable logging"
  4. Choose a destination (CloudWatch Logs, Amazon S3, or Amazon Data Firehose)
  5. Click "Save"

Note: Amazon Kinesis Data Firehose was renamed Amazon Data Firehose in February 2024, so the AWS WAF console and docs now list this destination as "Firehose" / "Amazon Data Firehose delivery stream".

text 
# Example CloudWatch Logs group name
aws-waf-logs-production-web-acl

Conclusion & Next Steps

Your ALB is now protected by AWS WAF with managed rule groups. The WAF will inspect all incoming HTTP/HTTPS traffic and block known attack patterns.

Next steps:

  • Monitor the WAF dashboard for blocked and counted requests, and switch rule groups from Count to Block once you have confirmed they do not affect legitimate traffic
  • Set up CloudWatch alarms for high block rates
  • Consider adding rate-based rules for application-layer rate limiting; note that associating the ALB already enabled resource-level DDoS protection automatically
  • Review and tune rules based on your application's needs

Troubleshooting

Legitimate traffic being blocked

Check CloudWatch Logs or S3 logs to identify the rule causing blocks. You can set specific rules to "Count" mode instead of "Block" while you investigate.

Can't find my ALB when associating

Make sure you're in the same AWS region as your ALB. Web ACLs are regional resources.

High costs after enabling WAF

Review the number of rules and request volume. Consider consolidating rules or using capacity units more efficiently.

Frequently Asked Questions

What's the difference between Web ACL and rule groups?

A Web ACL is a container that holds rules and rule groups. Rule groups are reusable collections of rules that you can add to multiple Web ACLs. AWS managed rule groups are pre-configured by AWS and updated automatically.

How much does AWS WAF cost?

AWS WAF charges based on Web ACLs ($5/month each), rules ($1/month each), and requests ($0.60 per million). Managed rule groups may have additional costs. Monitor your usage with AWS Cost Explorer.

Related Guides

How to Set Up Cloudflare WAF for WordPress

Step-by-step guide to configuring Cloudflare Web Application Firewall to protect your WordPress site from attacks.