implementing-cloud-waf-rules

# Implementing Cloud WAF Rules ## When to Use - When deploying new web applications or APIs behind cloud load balancers requiring OWASP protection - When application penetration testing reveals SQL injection, XSS, or other injection vulnerabilities - When experiencing brute force, credential stuffing, or bot attacks against authentication endpoints - When compliance requirements mandate a WAF for PCI-DSS or similar standards - When tuning WAF rules to reduce false positives blocking legitimate application traffic **Do not use** for network-level DDoS protection (use AWS Shield or Azure DDoS Protection), for API authentication design (see managing-cloud-identity-with-okta), or for application code-level security fixes (WAF is a compensating control, not a replacement for secure code). ## Prerequisites - AWS ALB/CloudFront, Azure Application Gateway, or Cloudflare configured as the application entry point - Application traffic logs for baseline analysis before WAF deployment - Test environment for validating WAF rules before production enforcement - Understanding of application request patterns to minimize false positives ## Workflow ### Step 1: Deploy Managed Rule Sets Enable cloud provider managed rule sets that cover OWASP Top 10 vulnerabilities. Start in Count (detection) mode before switching to Block (prevention) mode. ```bash # AWS WAF: Create Web ACL with AWS Managed Rules aws wafv2 create-web-acl \ --name production-waf \ --scope REGIONAL \ --default-act...