# AWS WAF API Protection — COUNT→BLOCK Checklist (July 2026)

## Attach points

- [ ] CloudFront and/or ALB and/or API Gateway / AppSync association chosen deliberately (one Web ACL model)
- [ ] Logging to S3 or CloudWatch with retention + redaction expectations

## Rule order (typical)

1. Allowlist / health checks  
2. AWS Managed Rules (Common Rule Set, Known Bad Inputs, Amazon IP reputation) — start in **COUNT**  
3. Rate-based rules (login, `/graphql`, expensive POSTs) — COUNT then BLOCK  
4. Bot Control (Common first; Targeted only if needed) — watch free-tier + CAPTCHA/Challenge charges  
5. Custom API rules (body size, missing auth header patterns)

## Safe rollout

- [ ] 48h COUNT on prod-like traffic  
- [ ] Review sampled/blocked candidates for false positives  
- [ ] Flip to BLOCK rule-by-rule  
- [ ] Alarm on `BlockedRequests` / `CountedRequests` spikes  

## Cost notes (verify [WAF pricing](https://aws.amazon.com/waf/pricing/))

Web ACL + rules + request volume; managed rule groups monthly; Bot Control / CAPTCHA / Challenge can dominate — model before enabling Targeted Bot Control on high-QPS APIs.

## WAF is not

AuthN/Z design, business-logic abuse, or Shield Advanced human DRT — stack those separately.