[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GRRYR4Y7MTSV593T6SR74":3,"skill-same:01M71GRRYR4Y7MTSV593T6SR74":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":14,"repositoryHtmlUrl":78,"repositoryHomepageUrl":6,"ownerHtmlUrl":79,"ownerBlogUrl":6,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M71GRRYR4Y7MTSV593T6SR74","api-wafgateway-monitor",null,"Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fwafgateway\u002Fmonitor\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"api wafgateway monitor","monitor","api","read","managed","rate","implementing","top","de","ip","cm","up","bot","Bash","owasp","cloud-security","monitoring","api gateway","owasp top 10","cybersecurity","2026-11-10 10:12:30",false,"---\nname: api-wafgateway-monitor\ndescription: Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- waf\n- api-gateway\n- rate-limiting\n- bot-protection\n- owasp\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1498\ncapec: []\n---\n\n# Securing API Gateway with AWS WAF\n\n## When to Use\n\n- When deploying API Gateway endpoints that require protection against common web attacks\n- When implementing rate limiting and throttling to prevent API abuse and DDoS attacks\n- When building bot detection and mitigation for API endpoints exposed to the internet\n- When compliance requires WAF protection for all public-facing API endpoints\n- When customizing access controls based on IP reputation, geolocation, or request patterns\n\n**Do not use** for network-level DDoS protection (use AWS Shield), for application logic vulnerabilities (use SAST\u002FDAST tools), or for internal API security between microservices (use service mesh authentication and authorization).\n\n## Prerequisites\n\n- AWS API Gateway (REST or HTTP API) deployed with public endpoints\n- IAM permissions for `wafv2:*` and `apigateway:*` operations\n- CloudWatch and S3 or Kinesis Firehose configured for WAF logging\n- Understanding of the API's expected traffic patterns for rate limiting configuration\n- IP reputation lists or threat intelligence feeds for custom IP blocking\n\n## Workflow\n\n### Step 1: Create a WAF Web ACL with Managed Rule Groups\n\nCreate a Web ACL with AWS Managed Rules for baseline protection against OWASP Top 10 attacks.\n\n```bash\n# Create a WAF Web ACL with managed rule groups\naws wafv2 create-web-acl \\\n  --name api-gateway-waf \\\n  --scope REGIONAL \\\n  --default-action '{\"Allow\":{}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"api-gateway-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"AWSManagedRulesCommonRuleSet\",\n      \"Priority\": 1,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesCommonRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"CommonRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\",\n      \"Priority\": 2,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"KnownBadInputs\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesSQLiRuleSet\",\n      \"Priority\": 3,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesSQLiRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"SQLiRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesAmazonIpReputationList\",\n      \"Priority\": 4,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesAmazonIpReputationList\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"IPReputationList\"\n      }\n    }\n  ]'\n```\n\n### Step 2: Add Rate Limiting Rules\n\nConfigure rate-based rules to throttle excessive API requests per IP address.\n\n```bash\n# Get the Web ACL ARN and lock token\nWEB_ACL_ARN=$(aws wafv2 list-web-acls --scope REGIONAL \\\n  --query \"WebACLs[?Name=='api-gateway-waf'].ARN\" --output text)\n\n# Update Web ACL to add rate limiting rule\naws wafv2 update-web-acl \\\n  --name api-gateway-waf \\\n  --scope REGIONAL \\\n  --id $(aws wafv2 list-web-acls --scope REGIONAL --query \"WebACLs[?Name=='api-gateway-waf'].Id\" --output text) \\\n  --lock-token $(aws wafv2 get-web-acl --name api-gateway-waf --scope REGIONAL --id WEB_ACL_ID --query 'LockToken' --output text) \\\n  --default-action '{\"Allow\":{}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"api-gateway-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"RateLimitPerIP\",\n      \"Priority\": 0,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 2000,\n          \"AggregateKeyType\": \"IP\"\n        }\n      },\n      \"Action\": {\"Block\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitPerIP\"\n      }\n    },\n    {\n      \"Name\": \"RateLimitLoginEndpoint\",\n      \"Priority\": 5,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 100,\n          \"AggregateKeyType\": \"IP\",\n          \"ScopeDownStatement\": {\n            \"ByteMatchStatement\": {\n              \"FieldToMatch\": {\"UriPath\": {}},\n              \"PositionalConstraint\": \"STARTS_WITH\",\n              \"SearchString\": \"\u002Fapi\u002Fauth\u002Flogin\",\n              \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"LOWERCASE\"}]\n            }\n          }\n        }\n      },\n      \"Action\": {\"Block\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitLogin\"\n      }\n    }\n  ]'\n```\n\n### Step 3: Implement Bot Control\n\nAdd AWS WAF Bot Control to detect and manage automated traffic.\n\n```bash\n# Add Bot Control managed rule group\n# (Add to the rules array when updating the Web ACL)\n{\n  \"Name\": \"AWSManagedRulesBotControlRuleSet\",\n  \"Priority\": 6,\n  \"Statement\": {\n    \"ManagedRuleGroupStatement\": {\n      \"VendorName\": \"AWS\",\n      \"Name\": \"AWSManagedRulesBotControlRuleSet\",\n      \"ManagedRuleGroupConfigs\": [{\n        \"AWSManagedRulesBotControlRuleSet\": {\n          \"InspectionLevel\": \"COMMON\"\n        }\n      }],\n      \"ExcludedRules\": [\n        {\"Name\": \"CategoryHttpLibrary\"},\n        {\"Name\": \"SignalNonBrowserUserAgent\"}\n      ]\n    }\n  },\n  \"OverrideAction\": {\"None\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"BotControl\"\n  }\n}\n```\n\n### Step 4: Create Custom Rules for API-Specific Protection\n\nBuild custom WAF rules for API-specific security requirements.\n\n```bash\n# Block requests without required API key header\n{\n  \"Name\": \"RequireAPIKey\",\n  \"Priority\": 7,\n  \"Statement\": {\n    \"NotStatement\": {\n      \"Statement\": {\n        \"ByteMatchStatement\": {\n          \"FieldToMatch\": {\n            \"SingleHeader\": {\"Name\": \"x-api-key\"}\n          },\n          \"PositionalConstraint\": \"EXACTLY\",\n          \"SearchString\": \"\",\n          \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"NONE\"}]\n        }\n      }\n    }\n  },\n  \"Action\": {\"Block\": {\"CustomResponse\": {\"ResponseCode\": 403}}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"RequireAPIKey\"\n  }\n}\n\n# Geo-restrict to allowed countries\n{\n  \"Name\": \"GeoRestriction\",\n  \"Priority\": 8,\n  \"Statement\": {\n    \"NotStatement\": {\n      \"Statement\": {\n        \"GeoMatchStatement\": {\n          \"CountryCodes\": [\"US\", \"CA\", \"GB\", \"DE\", \"FR\", \"AU\"]\n        }\n      }\n    }\n  },\n  \"Action\": {\"Block\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"GeoRestriction\"\n  }\n}\n\n# Block oversized request bodies (prevent payload attacks)\n{\n  \"Name\": \"MaxBodySize\",\n  \"Priority\": 9,\n  \"Statement\": {\n    \"SizeConstraintStatement\": {\n      \"FieldToMatch\": {\"Body\": {\"OversizeHandling\": \"MATCH\"}},\n      \"ComparisonOperator\": \"GT\",\n      \"Size\": 10240,\n      \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"NONE\"}]\n    }\n  },\n  \"Action\": {\"Block\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"MaxBodySize\"\n  }\n}\n```\n\n### Step 5: Associate WAF with API Gateway and Enable Logging\n\nAttach the Web ACL to the API Gateway stage and configure comprehensive logging.\n\n```bash\n# Associate Web ACL with API Gateway\naws wafv2 associate-web-acl \\\n  --web-acl-arn $WEB_ACL_ARN \\\n  --resource-arn arn:aws:apigateway:us-east-1::\u002Frestapis\u002FAPI_ID\u002Fstages\u002Fprod\n\n# Enable WAF logging to S3 via Kinesis Firehose\naws wafv2 put-logging-configuration \\\n  --logging-configuration '{\n    \"ResourceArn\": \"'$WEB_ACL_ARN'\",\n    \"LogDestinationConfigs\": [\n      \"arn:aws:firehose:us-east-1:ACCOUNT:deliverystream\u002Faws-waf-logs-api-gateway\"\n    ],\n    \"RedactedFields\": [\n      {\"SingleHeader\": {\"Name\": \"authorization\"}},\n      {\"SingleHeader\": {\"Name\": \"cookie\"}}\n    ]\n  }'\n\n# Verify association\naws wafv2 get-web-acl-for-resource \\\n  --resource-arn arn:aws:apigateway:us-east-1::\u002Frestapis\u002FAPI_ID\u002Fstages\u002Fprod\n```\n\n### Step 6: Monitor WAF Metrics and Tune Rules\n\nMonitor WAF effectiveness and tune rules to reduce false positives.\n\n```bash\n# Get WAF metrics from CloudWatch\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FWAFV2 \\\n  --metric-name BlockedRequests \\\n  --dimensions Name=WebACL,Value=api-gateway-waf Name=Rule,Value=ALL \\\n  --start-time 2026-02-22T00:00:00Z \\\n  --end-time 2026-02-23T00:00:00Z \\\n  --period 3600 \\\n  --statistics Sum\n\n# Get sampled requests for a specific rule\naws wafv2 get-sampled-requests \\\n  --web-acl-arn $WEB_ACL_ARN \\\n  --rule-metric-name RateLimitPerIP \\\n  --scope REGIONAL \\\n  --time-window '{\"StartTime\":\"2026-02-22T00:00:00Z\",\"EndTime\":\"2026-02-23T00:00:00Z\"}' \\\n  --max-items 50\n\n# Check rate-limited IPs\naws wafv2 get-rate-based-statement-managed-keys \\\n  --web-acl-name api-gateway-waf \\\n  --scope REGIONAL \\\n  --web-acl-id WEB_ACL_ID \\\n  --rule-name RateLimitPerIP\n\n# Create CloudWatch alarm for high block rate\naws cloudwatch put-metric-alarm \\\n  --alarm-name waf-high-block-rate \\\n  --namespace AWS\u002FWAFV2 \\\n  --metric-name BlockedRequests \\\n  --dimensions Name=WebACL,Value=api-gateway-waf Name=Rule,Value=ALL \\\n  --statistic Sum --period 300 --threshold 1000 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 2 \\\n  --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:security-alerts\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Web ACL | AWS WAF access control list that defines the collection of rules and their actions (allow, block, count) applied to associated resources |\n| Managed Rule Group | Pre-configured set of WAF rules maintained by AWS or third-party vendors for common attack patterns like OWASP Top 10 |\n| Rate-Based Rule | WAF rule that tracks request rates per IP address and blocks traffic exceeding a defined threshold within a 5-minute window |\n| Bot Control | AWS WAF managed rule group that identifies and manages automated traffic including scrapers, crawlers, and attack bots |\n| IP Reputation List | AWS-maintained list of IP addresses associated with malicious activity including botnets, scanners, and known attackers |\n| Custom Response | WAF capability to return specific HTTP status codes and custom response bodies when blocking requests |\n\n## Tools & Systems\n\n- **AWS WAF**: Web application firewall service for protecting API Gateway, ALB, CloudFront, and AppSync endpoints\n- **AWS Managed Rules**: Pre-built rule groups for common attack patterns maintained by AWS security team\n- **AWS Firewall Manager**: Central management of WAF policies across multiple accounts in AWS Organizations\n- **Kinesis Firehose**: Streaming delivery service for WAF logs to S3, Elasticsearch, or third-party analytics\n- **CloudWatch**: Monitoring service for WAF metrics including allowed, blocked, and counted requests\n\n## Common Scenarios\n\n### Scenario: Protecting a Public API from Credential Stuffing and Bot Attacks\n\n**Context**: A public REST API experiences thousands of authentication attempts per hour from automated bots attempting credential stuffing against the `\u002Fapi\u002Fauth\u002Flogin` endpoint.\n\n**Approach**:\n1. Create a Web ACL with AWS Managed Rules Common Rule Set for baseline protection\n2. Add a rate-based rule limiting the login endpoint to 100 requests per IP per 5 minutes\n3. Enable Bot Control managed rules to detect and block automated traffic\n4. Add IP Reputation List to block known malicious IPs proactively\n5. Create a custom rule blocking requests without proper User-Agent headers\n6. Enable WAF logging and create CloudWatch alarms for high block rates\n7. Review sampled blocked requests weekly to tune rules and reduce false positives\n\n**Pitfalls**: Rate limiting by IP can block legitimate users behind shared NAT gateways or corporate proxies. Consider using API key or authenticated session-based rate limiting for more granular control. Bot Control rules in COMMON inspection level may block legitimate API clients; start in Count mode and review before switching to Block.\n\n## Output Format\n\n```\nAWS WAF API Gateway Security Report\n======================================\nWeb ACL: api-gateway-waf\nAssociated Resource: API Gateway - production-api (prod stage)\nReport Period: 2026-02-16 to 2026-02-23\n\nTRAFFIC SUMMARY:\n  Total requests:              2,450,000\n  Allowed requests:            2,380,000 (97.1%)\n  Blocked requests:               70,000 (2.9%)\n\nBLOCKS BY RULE:\n  RateLimitPerIP:              28,000 (40%)\n  AWSManagedRulesCommonRuleSet: 18,000 (25.7%)\n  BotControl:                  12,000 (17.1%)\n  SQLiRuleSet:                  5,000 (7.1%)\n  IPReputationList:             4,000 (5.7%)\n  RateLimitLogin:               2,000 (2.9%)\n  GeoRestriction:               1,000 (1.4%)\n\nTOP BLOCKED IPs:\n  185.x.x.x:     8,400 requests (rate limited)\n  45.x.x.x:      5,200 requests (bot detected)\n  198.x.x.x:     3,100 requests (SQLi attempts)\n\nATTACK TYPES BLOCKED:\n  Credential stuffing (login endpoint):  2,000\n  SQL injection attempts:                5,000\n  Cross-site scripting:                  3,200\n  Known bad bot traffic:                12,000\n  Rate limit violations:               28,000\n\nWAF RULE HEALTH:\n  Rules in Block mode:    8 \u002F 10\n  Rules in Count mode:    2 \u002F 10 (under evaluation)\n  False positive rate:    \u003C 0.1%\n```\n","# Securing API Gateway with AWS WAF\n\n## When to Use\n\n- When deploying API Gateway endpoints that require protection against common web attacks\n- When implementing rate limiting and throttling to prevent API abuse and DDoS attacks\n- When building bot detection and mitigation for API endpoints exposed to the internet\n- When compliance requires WAF protection for all public-facing API endpoints\n- When customizing access controls based on IP reputation, geolocation, or request patterns\n\n**Do not use** for network-level DDoS protection (use AWS Shield), for application logic vulnerabilities (use SAST\u002FDAST tools), or for internal API security between microservices (use service mesh authentication and authorization).\n\n## Prerequisites\n\n- AWS API Gateway (REST or HTTP API) deployed with public endpoints\n- IAM permissions for `wafv2:*` and `apigateway:*` operations\n- CloudWatch and S3 or Kinesis Firehose configured for WAF logging\n- Understanding of the API's expected traffic patterns for rate limiting configuration\n- IP reputation lists or threat intelligence feeds for custom IP blocking\n\n## Workflow\n\n### Step 1: Create a WAF Web ACL with Managed Rule Groups\n\nCreate a Web ACL with AWS Managed Rules for baseline protection against OWASP Top 10 attacks.\n\n```bash\n# Create a WAF Web ACL with managed rule groups\naws wafv2 create-web-acl \\\n  --name api-gateway-waf \\\n  --scope REGIONAL \\\n  --default-action '{\"Allow\":{}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"api-gateway-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"AWSManagedRulesCommonRuleSet\",\n      \"Priority\": 1,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesCommonRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"CommonRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\",\n      \"Priority\": 2,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesKnownBadInputsRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"KnownBadInputs\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesSQLiRuleSet\",\n      \"Priority\": 3,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesSQLiRuleSet\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"SQLiRuleSet\"\n      }\n    },\n    {\n      \"Name\": \"AWSManagedRulesAmazonIpReputationList\",\n      \"Priority\": 4,\n      \"Statement\": {\n        \"ManagedRuleGroupStatement\": {\n          \"VendorName\": \"AWS\",\n          \"Name\": \"AWSManagedRulesAmazonIpReputationList\"\n        }\n      },\n      \"OverrideAction\": {\"None\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"IPReputationList\"\n      }\n    }\n  ]'\n```\n\n### Step 2: Add Rate Limiting Rules\n\nConfigure rate-based rules to throttle excessive API requests per IP address.\n\n```bash\n# Get the Web ACL ARN and lock token\nWEB_ACL_ARN=$(aws wafv2 list-web-acls --scope REGIONAL \\\n  --query \"WebACLs[?Name=='api-gateway-waf'].ARN\" --output text)\n\n# Update Web ACL to add rate limiting rule\naws wafv2 update-web-acl \\\n  --name api-gateway-waf \\\n  --scope REGIONAL \\\n  --id $(aws wafv2 list-web-acls --scope REGIONAL --query \"WebACLs[?Name=='api-gateway-waf'].Id\" --output text) \\\n  --lock-token $(aws wafv2 get-web-acl --name api-gateway-waf --scope REGIONAL --id WEB_ACL_ID --query 'LockToken' --output text) \\\n  --default-action '{\"Allow\":{}}' \\\n  --visibility-config '{\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"api-gateway-waf\"\n  }' \\\n  --rules '[\n    {\n      \"Name\": \"RateLimitPerIP\",\n      \"Priority\": 0,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 2000,\n          \"AggregateKeyType\": \"IP\"\n        }\n      },\n      \"Action\": {\"Block\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitPerIP\"\n      }\n    },\n    {\n      \"Name\": \"RateLimitLoginEndpoint\",\n      \"Priority\": 5,\n      \"Statement\": {\n        \"RateBasedStatement\": {\n          \"Limit\": 100,\n          \"AggregateKeyType\": \"IP\",\n          \"ScopeDownStatement\": {\n            \"ByteMatchStatement\": {\n              \"FieldToMatch\": {\"UriPath\": {}},\n              \"PositionalConstraint\": \"STARTS_WITH\",\n              \"SearchString\": \"\u002Fapi\u002Fauth\u002Flogin\",\n              \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"LOWERCASE\"}]\n            }\n          }\n        }\n      },\n      \"Action\": {\"Block\": {}},\n      \"VisibilityConfig\": {\n        \"SampledRequestsEnabled\": true,\n        \"CloudWatchMetricsEnabled\": true,\n        \"MetricName\": \"RateLimitLogin\"\n      }\n    }\n  ]'\n```\n\n### Step 3: Implement Bot Control\n\nAdd AWS WAF Bot Control to detect and manage automated traffic.\n\n```bash\n# Add Bot Control managed rule group\n# (Add to the rules array when updating the Web ACL)\n{\n  \"Name\": \"AWSManagedRulesBotControlRuleSet\",\n  \"Priority\": 6,\n  \"Statement\": {\n    \"ManagedRuleGroupStatement\": {\n      \"VendorName\": \"AWS\",\n      \"Name\": \"AWSManagedRulesBotControlRuleSet\",\n      \"ManagedRuleGroupConfigs\": [{\n        \"AWSManagedRulesBotControlRuleSet\": {\n          \"InspectionLevel\": \"COMMON\"\n        }\n      }],\n      \"ExcludedRules\": [\n        {\"Name\": \"CategoryHttpLibrary\"},\n        {\"Name\": \"SignalNonBrowserUserAgent\"}\n      ]\n    }\n  },\n  \"OverrideAction\": {\"None\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"BotControl\"\n  }\n}\n```\n\n### Step 4: Create Custom Rules for API-Specific Protection\n\nBuild custom WAF rules for API-specific security requirements.\n\n```bash\n# Block requests without required API key header\n{\n  \"Name\": \"RequireAPIKey\",\n  \"Priority\": 7,\n  \"Statement\": {\n    \"NotStatement\": {\n      \"Statement\": {\n        \"ByteMatchStatement\": {\n          \"FieldToMatch\": {\n            \"SingleHeader\": {\"Name\": \"x-api-key\"}\n          },\n          \"PositionalConstraint\": \"EXACTLY\",\n          \"SearchString\": \"\",\n          \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"NONE\"}]\n        }\n      }\n    }\n  },\n  \"Action\": {\"Block\": {\"CustomResponse\": {\"ResponseCode\": 403}}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"RequireAPIKey\"\n  }\n}\n\n# Geo-restrict to allowed countries\n{\n  \"Name\": \"GeoRestriction\",\n  \"Priority\": 8,\n  \"Statement\": {\n    \"NotStatement\": {\n      \"Statement\": {\n        \"GeoMatchStatement\": {\n          \"CountryCodes\": [\"US\", \"CA\", \"GB\", \"DE\", \"FR\", \"AU\"]\n        }\n      }\n    }\n  },\n  \"Action\": {\"Block\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"GeoRestriction\"\n  }\n}\n\n# Block oversized request bodies (prevent payload attacks)\n{\n  \"Name\": \"MaxBodySize\",\n  \"Priority\": 9,\n  \"Statement\": {\n    \"SizeConstraintStatement\": {\n      \"FieldToMatch\": {\"Body\": {\"OversizeHandling\": \"MATCH\"}},\n      \"ComparisonOperator\": \"GT\",\n      \"Size\": 10240,\n      \"TextTransformations\": [{\"Priority\": 0, \"Type\": \"NONE\"}]\n    }\n  },\n  \"Action\": {\"Block\": {}},\n  \"VisibilityConfig\": {\n    \"SampledRequestsEnabled\": true,\n    \"CloudWatchMetricsEnabled\": true,\n    \"MetricName\": \"MaxBodySize\"\n  }\n}\n```\n\n### Step 5: Associate WAF with API Gateway and Enable Logging\n\nAttach the Web ACL to the API Gateway stage and configure comprehensive logging.\n\n```bash\n# Associate Web ACL with API Gateway\naws wafv2 associate-web-acl \\\n  --web-acl-arn $WEB_ACL_ARN \\\n  --resource-arn arn:aws:apigateway:us-east-1::\u002Frestapis\u002FAPI_ID\u002Fstages\u002Fprod\n\n# Enable WAF logging to S3 via Kinesis Firehose\naws wafv2 put-logging-configuration \\\n  --logging-configuration '{\n    \"ResourceArn\": \"'$WEB_ACL_ARN'\",\n    \"LogDestinationConfigs\": [\n      \"arn:aws:firehose:us-east-1:ACCOUNT:deliverystream\u002Faws-waf-logs-api-gateway\"\n    ],\n    \"RedactedFields\": [\n      {\"SingleHeader\": {\"Name\": \"authorization\"}},\n      {\"SingleHeader\": {\"Name\": \"cookie\"}}\n    ]\n  }'\n\n# Verify association\naws wafv2 get-web-acl-for-resource \\\n  --resource-arn arn:aws:apigateway:us-east-1::\u002Frestapis\u002FAPI_ID\u002Fstages\u002Fprod\n```\n\n### Step 6: Monitor WAF Metrics and Tune Rules\n\nMonitor WAF effectiveness and tune rules to reduce false positives.\n\n```bash\n# Get WAF metrics from CloudWatch\naws cloudwatch get-metric-statistics \\\n  --namespace AWS\u002FWAFV2 \\\n  --metric-name BlockedRequests \\\n  --dimensions Name=WebACL,Value=api-gateway-waf Name=Rule,Value=ALL \\\n  --start-time 2026-02-22T00:00:00Z \\\n  --end-time 2026-02-23T00:00:00Z \\\n  --period 3600 \\\n  --statistics Sum\n\n# Get sampled requests for a specific rule\naws wafv2 get-sampled-requests \\\n  --web-acl-arn $WEB_ACL_ARN \\\n  --rule-metric-name RateLimitPerIP \\\n  --scope REGIONAL \\\n  --time-window '{\"StartTime\":\"2026-02-22T00:00:00Z\",\"EndTime\":\"2026-02-23T00:00:00Z\"}' \\\n  --max-items 50\n\n# Check rate-limited IPs\naws wafv2 get-rate-based-statement-managed-keys \\\n  --web-acl-name api-gateway-waf \\\n  --scope REGIONAL \\\n  --web-acl-id WEB_ACL_ID \\\n  --rule-name RateLimitPerIP\n\n# Create CloudWatch alarm for high block rate\naws cloudwatch put-metric-alarm \\\n  --alarm-name waf-high-block-rate \\\n  --namespace AWS\u002FWAFV2 \\\n  --metric-name BlockedRequests \\\n  --dimensions Name=WebACL,Value=api-gateway-waf Name=Rule,Value=ALL \\\n  --statistic Sum --period 300 --threshold 1000 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 2 \\\n  --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:security-alerts\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Web ACL | AWS WAF access control list that defines the collection of rules and their actions (allow, block, count) applied to associated resources |\n| Managed Rule Group | Pre-configured set of WAF rules maintained by AWS or third-party vendors for common attack patterns like OWASP Top 10 |\n| Rate-Based Rule | WAF rule that tracks request rates per IP address and blocks traffic exceeding a defined threshold within a 5-minute window |\n| Bot Control | AWS WAF managed rule group that identifies and manages automated traffic including scrapers, crawlers, and attack bots |\n| IP Reputation List | AWS-maintained list of IP addresses associated with malicious activity including botnets, scanners, and known attackers |\n| Custom Response | WAF capability to return specific HTTP status codes and custom response bodies when blocking requests |\n\n## Tools & Systems\n\n- **AWS WAF**: Web application firewall service for protecting API Gateway, ALB, CloudFront, and AppSync endpoints\n- **AWS Managed Rules**: Pre-built rule groups for common attack patterns maintained by AWS security team\n- **AWS Firewall Manager**: Central management of WAF policies across multiple accounts in AWS Organizations\n- **Kinesis Firehose**: Streaming delivery service for WAF logs to S3, Elasticsearch, or third-party analytics\n- **CloudWatch**: Monitoring service for WAF metrics including allowed, blocked, and counted requests\n\n## Common Scenarios\n\n### Scenario: Protecting a Public API from Credential Stuffing and Bot Attacks\n\n**Context**: A public REST API experiences thousands of authentication attempts per hour from automated bots attempting credential stuffing against the `\u002Fapi\u002Fauth\u002Flogin` endpoint.\n\n**Approach**:\n1. Create a Web ACL with AWS Managed Rules Common Rule Set for baseline protection\n2. Add a rate-based rule limiting the login endpoint to 100 requests per IP per 5 minutes\n3. Enable Bot Control managed rules to detect and block automated traffic\n4. Add IP Reputation List to block known malicious IPs proactively\n5. Create a custom rule blocking requests without proper User-Agent headers\n6. Enable WAF logging and create CloudWatch alarms for high block rates\n7. Review sampled blocked requests weekly to tune rules and reduce false positives\n\n**Pitfalls**: Rate limiting by IP can block legitimate users behind shared NAT gateways or corporate proxies. Consider using API key or authenticated session-based rate limiting for more granular control. Bot Control rules in COMMON inspection level may block legitimate API clients; start in Count mode and review before switching to Block.\n\n## Output Format\n\n```\nAWS WAF API Gateway Security Report\n======================================\nWeb ACL: api-gateway-waf\nAssociated Resource: API Gateway - production-api (prod stage)\nReport Period: 2026-02-16 to 2026-02-23\n\nTRAFFIC SUMMARY:\n  Total requests:              2,450,000\n  Allowed requests:            2,380,000 (97.1%)\n  Blocked requests:               70,000 (2.9%)\n\nBLOCKS BY RULE:\n  RateLimitPerIP:              28,000 (40%)\n  AWSManagedRulesCommonRuleSet: 18,000 (25.7%)\n  BotControl:                  12,000 (17.1%)\n  SQLiRuleSet:                  5,000 (7.1%)\n  IPReputationList:             4,000 (5.7%)\n  RateLimitLogin:               2,000 (2.9%)\n  GeoRestriction:               1,000 (1.4%)\n\nTOP BLOCKED IPs:\n  185.x.x.x:     8,400 requests (rate limited)\n  45.x.x.x:      5,200 requests (bot detected)\n  198.x.x.x:     3,100 requests (SQLi attempts)\n\nATTACK TYPES BLOCKED:\n  Credential stuffing (login endpoint):  2,000\n  SQL injection attempts:                5,000\n  Cross-site scripting:                  3,200\n  Known bad bot traffic:                12,000\n  Rate limit violations:               28,000\n\nWAF RULE HEALTH:\n  Rules in Block mode:    8 \u002F 10\n  Rules in Count mode:    2 \u002F 10 (under evaluation)\n  False positive rate:    \u003C 0.1%\n```\n",{"name":5,"tags":54,"capec":60,"model":61,"tools":62,"domain":48,"maxTurns":66,"nist_csf":67,"subdomain":44,"description":7,"mitre_attack":72},[44,55,56,57,58,59,43],"aws","waf","api-gateway","rate-limiting","bot-protection",[],"sonnet",[63,42,64,65],"Read","Glob","Grep",20,[68,69,70,71],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[73,74],"T1059","T1498","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fapi\u002Fwafgateway\u002Fmonitor","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill api-wafgateway-monitor",{"tool":88,"command":89},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill api-wafgateway-monitor",{"tool":91,"command":92},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill api-wafgateway-monitor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fwafgateway\u002Fmonitor\u002FSKILL.md",true,[96],{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"index.json","REFERENCE","参考文档",697,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fwafgateway\u002Fmonitor\u002Findex.json",[103,126,147,168,190,205],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":49},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[110,111,112,113,114,37,39,115,116,117,118,119,120,121,122,123,124,48,125],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":49},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[133,110,134,113,135,136,137,48,42,138,139,140,141,142,37,143,144,32,145,146],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":49},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[154,155,156,157,158,159,48,42,160,138,161,162,37,32,163,164,165,166,167,61],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":49},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[111,175,176,177,178,179,180,39,181,48,125,182,183,184,185,186,187,188,189,37],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":196,"publishedAt":49},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[197,198,111,199,177,179,200,39,201,181,48,125,138,31,202,203,204,189,37,115],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":49},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[212,111,177,213,200,39,214,215,48,125,216,217,218,219,220,221,37,115,222,223],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]