I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local credentials to the app, as it is not possible to use SAML).

In this context, does it make sense to put a WAF? A potential attacker could not launch attacks if he is not authenticated (unless also valid credentials were stolen).

Note aside: When I say WAF, I'm talking about AWS standard WAF (not shield). I'm concerned about DDoS attacks mostly, because AWS standard WAF only covers layer 3/4 attacks not layer 7 (unless you pay Shield, which is above the budget.)

  • 3
    I don't understand your question. You say you are mostly worried about DDoS attacks, then say that the thing you are skeptical about would exactly solve your problem. What is your actual question?
    – user163495
    Commented Apr 20, 2020 at 14:08
  • Thanks for your comments. Just to clarify a little bit @MechMK1. - Moving aside my specific question about ddos, does it make sense to have a waf when you are using cognito+External Identity provider? The only attack that I can think of without having compromise a company account is dos or ddos. - Is there any way to add layer 7 protection against ddos withouth paying for AWS shield advanced? let me know if I have to edit the post itself with this information
    – FaridHazan
    Commented Apr 20, 2020 at 15:56
  • I don't have personal experience with cognito, so it's hard to tell for me. But in general, many businesses use a WAF as a defense-in-depth approach
    – user163495
    Commented Apr 20, 2020 at 17:35
  • @FaridHazan, just because an app is protected by auth doesn't mean it's "secure". It could still be vulnerable to SQLi/XSS/etc.
    – phbits
    Commented Apr 20, 2020 at 21:32
  • standard WAF only covers layer 3/4 attacks How is it called a web application firewall WAF? Web applications live on the application layer. Commented Apr 24, 2020 at 22:04

1 Answer 1


The question here contains a fundamentally incorrect statement "...because AWS standard WAF only covers layer 3/4 attacks not layer 7".

AWS WAF covers layer 7 HTTP attacks (Shield is not required), and for DDoS it can do quite a lot!! It has rate-based rules and IP Reputation rule-groups, both of which can be extremely effective.

The two most effective rules to put into place for anti-DDoS are (in order):

  • a "ddos-botnet" rate-based rule with a custom aggregation key comprising "method, Header(Host), uri, IP" which picks up requests from clients behaving in a botnet-like fashion i.e. hitting the same URI over and over - with a low limit (100 would be suitable the majority of sites except some API endpoints which are continously polled)
  • the AWSManagedIPReputation rulegroup with the IPDDoSList rule in 'Block' mode

Other useful rules can include:

  • a "catch-all" rate-based rule with no scope-down statement
  • other AWS managed IP reputation rulegroups

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .