Key points

• Web ACLs can be associated with supported application endpoints such as API Gateway stages and CloudFront distributions.
• WAF evaluates request characteristics at the web boundary.
• It complements rather than replaces application authentication, authorization, validation, and sanitization.

Best-known use cases

• Apply managed or custom web request rules to an API or distribution.
• Block or count request patterns at a supported edge or API boundary.

What candidates often confuse it with

• AWS WAF filters web requests; API authorizers validate identity and claims.
• WAF rules do not replace safe application input handling.

Key takeaway

Recognize AWS WAF as web-request protection around supported endpoints, not as the application authorization layer.

Related services

• Amazon API Gateway
• Amazon CloudFront

Relevant exam tasks

• D1.1 — Develop code for applications hosted on AWS
• 1.1.6 — Create, extend, and maintain APIs (for example, response/request transformations, enforcing validation rules, overriding status codes)
• D2.1 — Implement authentication and/or authorization for applications and AWS services
• 2.1.7 — Implement application-level authorization for fine-grained access control

Learn more

• AWS WAF