Security, Identity, and Compliance
AWS WAF
AWS WAF filters HTTP requests reaching supported resources using managed and custom web ACL rules. It reduces common web exploits and abusive traffic before requests enter a GenAI API, complementing model-level safety controls.
Key points
- Managed rule groups cover common application threats
- Rate-based rules limit matching source traffic
- Logs and sampled requests support tuning but may contain sensitive fields
When to use it
- Rate-limit automated abuse of a public chat endpoint
- Block known malicious request patterns at CloudFront or API Gateway
Exam tips
- Choose WAF for HTTP-layer protection and Bedrock Guardrails for semantic content policy
- A source-IP rate limit alone is weak behind shared networks, so combine identity quotas and downstream cost controls