WAF
AWS WAF is managed in Terraform and associated with the API Gateway stage before Lambda execution.
Config
Relevant Terraform files live under platform/terraform/env-*/:
| File | Responsibility |
|---|---|
main.waf.tf | Web ACL association with the API Gateway stage |
main.waf.acl.tf | Web ACL rules, priority order, managed groups |
main.waf.iplists.tf | IPv4/IPv6 allow and deny lists |
main.waf.logging.tf | Kinesis Firehose logging pipeline |
main.waf.s3.tf | S3 backing bucket for WAF logs |
main.waf.iam.tf | IAM for Firehose/log delivery |
Rule order
The Web ACL default action is allow. Explicit rules then allow or block before a request reaches API Gateway integration code:
- Whitelist IP sets allow known CIDRs.
- Blacklist IP sets block known CIDRs.
- Good-bot user agents are allowed.
- Rate-based rules block high-volume client IPs.
- Managed AWS rule groups cover common exploit signatures and reputation lists.
Rate-based rules
WAF rate limits are IP-scoped and independent of API Gateway API keys. They apply to both private: true and private: false routes because the decision happens before Lambda.
This is separate from:
- API Gateway usage-plan throttling, which is per API key.
- In-handler token buckets such as the leads inbound rate limiter.
Logging
WAF logs are delivered through Kinesis Firehose into S3. Use the WAF log bucket and rule metric names when investigating blocks that never appear in Lambda logs.