AWS WAF for web application firewall - Step-by-Step Execution

Process Flow - AWS WAF for web application firewall

Start: Web Request Received

↓

AWS WAF Inspects Request

↓

Check Against Rules

↓

Match

↓

Block or Allow

↓

Request Sent to Web Application

AWS WAF checks each web request against rules and decides to block or allow it before it reaches your web app.

Execution Sample

AWS

1. Receive web request
2. Inspect request with AWS WAF
3. Match request against rules
4. If match, block or allow
5. Forward allowed requests

This flow shows how AWS WAF processes a web request to protect your web application.

Process Table

Step	Action	Request Detail	Rule Match	Decision	Result
1	Receive request	GET /login	N/A	N/A	Request received
2	Inspect request	Headers and IP checked	N/A	N/A	Inspection started
3	Check rule 1	IP blocklist	No	Continue	No match, check next
4	Check rule 2	SQL injection pattern	Yes	Block	Request blocked
5	Decision made	Block request	Yes	Block	Request denied, no forward
6	End	Request blocked	N/A	N/A	Request stopped at WAF

💡 Request blocked at step 5 due to matching SQL injection rule

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
Request Status	Received	Inspected	Checked Rule 1	Matched Rule 2	Blocked
Rule Match	None	None	No	Yes	Yes
Decision	None	None	Continue	Block	Block

Key Moments - 2 Insights

Why does the request get blocked even though it passed the first rule?

Because AWS WAF checks all rules in order. The request failed the second rule (SQL injection), so it is blocked as shown in execution_table row 4 and 5.

What happens if no rules match the request?

If no rules match, AWS WAF allows the request to pass through to the web application, as shown in the 'No Match' branch in the concept_flow.

Visual Quiz - 3 Questions

Look at the execution table, what is the decision at step 3?

A Continue checking rules

B Block the request

C Allow the request immediately

D Drop the request silently

💡 Hint

Refer to execution_table row 3 under 'Decision' column

At which step does the request get blocked?

A Step 2

B Step 4

C Step 3

D Step 6

💡 Hint

Check execution_table rows 4 and 5 for when 'Block' decision occurs

If the SQL injection rule was removed, what would happen at step 4?

A Request would be blocked anyway

B Request would be dropped silently

C Request would continue to next rule or allowed

D AWS WAF would crash

💡 Hint

Refer to execution_table row 4 where rule match affects decision

Concept Snapshot

AWS WAF checks incoming web requests against security rules.
If a request matches a blocking rule, it is stopped.
If no rules match, the request passes to your web app.
Rules can block IPs, detect attacks like SQL injection.
AWS WAF protects your app by filtering bad traffic early.

Full Transcript

AWS WAF acts like a security guard for your web application. When a web request arrives, AWS WAF inspects it carefully. It checks the request against a list of rules you set up, such as blocking bad IP addresses or detecting attack patterns like SQL injection. If the request matches a blocking rule, AWS WAF stops it and does not let it reach your web app. If it does not match any rule, the request is allowed through. This process helps keep your web application safe from harmful traffic.