AWS WAF and CloudFront Security: What a DevOps Engineer Configures and What Protection You Get in 2026

1. OWASP Top 10 Web Exploits (AWS Managed Core Rule Group)

AWS provides a managed Core Rule Group that covers the most common web exploits from the OWASP Top 10: SQL injection, cross-site scripting (XSS), local file inclusion, command injection, and server-side request forgery (SSRF). This rule group is maintained by AWS and updated automatically when new attack patterns are discovered.

A DevOps engineer enables the AWS-AWSManagedRulesCommonRuleSet on the WAF WebACL and configures the action to Block. The rule group inspects request body, headers, URI, and query string parameters for malicious patterns. False positives are managed by setting specific rules to Count rather than Block until the team confirms they are not affecting legitimate traffic.

2. Known Bad IP Reputation (AWS Managed IP Reputation List)

AWS maintains an IP reputation list of known malicious IP ranges: Tor exit nodes, botnet command-and-control servers, and IP addresses associated with recent DDoS attacks and scanning activity.

A DevOps engineer enables the AWS-AWSManagedRulesAmazonIpReputationList rule group. Requests from IPs on this list are blocked at the edge before they reach the application. This is the lowest-effort, highest-impact WAF rule for most SaaS products.

3. Bot Control (Automated Traffic Management)

Bots account for a significant portion of web traffic. Some bots are legitimate (search engine crawlers, monitoring services). Others are malicious: credential stuffing bots that test stolen username and password combinations, scraping bots that harvest content, and inventory bots.

A DevOps engineer configures AWS Bot Control, which distinguishes between verified bots (Google, Bing, LinkedIn) and unverified automated traffic. Unverified bots are served a CAPTCHA challenge (Browser Challenge). Bots that fail the challenge are blocked. This is particularly valuable for SaaS login endpoints targeted by credential stuffing attacks.

4. Account Takeover Protection (Credential Stuffing)

Credential stuffing attacks use large lists of stolen username and password combinations to attempt login to accounts. A high volume of failed login attempts against the same endpoint is the signature.

AWS WAF Fraud Control - Account Takeover Prevention monitors login endpoints for credential stuffing signals: high request rate to the login endpoint, high ratio of failed login responses, and requests with compromised credential patterns. A DevOps engineer configures the login endpoint path and enables automated blocking when credential stuffing is detected.

5. Rate Limiting (Volumetric Attack Protection)

Rate-based rules in AWS WAF count requests from a source IP over a 5-minute window and block the IP when requests exceed a configured threshold. A DevOps engineer sets rate limits appropriate for the application: a normal user does not send more than 100 requests per 5 minutes, so a threshold of 500 per 5 minutes blocks aggressive scrapers and DDoS amplification traffic without affecting legitimate users.

Rate limits are configured per endpoint: the login endpoint gets a tighter limit (50 requests per 5 minutes) than the main application (2,000 requests per 5 minutes).

6. Geographic Restrictions (Geo-Blocking)

If the SaaS product is only intended for users in specific countries, a DevOps engineer configures geographic restriction rules to block requests from countries the product does not serve. This is not a security control in isolation but reduces the attack surface from countries with high volumes of automated malicious traffic.

Geo-blocking is configured in either CloudFront (which blocks at the CDN layer for all content) or AWS WAF (which allows fine-grained per-endpoint geo-blocking). A DevOps engineer configures the approach based on whether the product has APIs that need to remain globally accessible while the frontend is geo-restricted.

Region / model

In-house DevOps

Eastern Europe agency

Acquaint Softtech ($22/hr)

UK

GBP 80,000-110,000/yr

GBP 60-80/hr

$22/hour | $3,200/month

Germany / DACH

EUR 90,000-120,000/yr

EUR 70-90/hr

$22/hour | $3,200/month

Netherlands

EUR 85,000-115,000/yr

EUR 65-85/hr

$22/hour | $3,200/month

US

$130,000-180,000/yr

$80-110/hr

$22/hour | $3,200/month

WAF engagement scope

Cost at $22/hour

What is delivered

WAF assessment (what is missing)

1 to 2 days: $176 to $352

Findings report: current edge security posture, missing rule groups, priority order recommendation

Core rules + IP reputation (Priorities 1-2)

1 to 2 days: $176 to $352

WebACL creation, Core Rule Group, IP Reputation List, CloudFront association, ALB lockdown

Bot Control + Account Takeover (Priorities 3-4)

1 to 2 days: $176 to $352

Bot Control common, Account Takeover Protection on login endpoint, CAPTCHA challenge flow

Rate limiting + geo-blocking + logging (Priorities 5-6)

1 to 2 days: $176 to $352

Rate-based rules per endpoint, geographic restrictions, WAF logs to S3 and CloudWatch

Full WAF + CloudFront security setup

3 to 6 days: $528 to $1,056

Complete edge security: all 6 rule categories, CloudFront-only origin access, logging, alerting

Monthly retainer (WAF + broader security)

$3,200/month

Ongoing: WAF rule tuning, false positive management, new threat response, quarterly review