AWS WAF Reviews

We primarily use this solution for monitoring and blocking to ensure protection against application layer attacks. These include application-related core rules, database-specific attacks, Linux-based attacks and some custom rules deployed. These rules assist us in blocking specific attacks that come from the internet into our cloud infrastructure.

The customizable features are good. For example, we can write our own rules and match character and size limits.

The product could be improved by expanding the weightage units of rules we have when writing policy. Currently, our company uses WAF policy and Web ACL but is limited to only 1500 units of rules.

We have been using this solution for three years and are currently using version two. We deploy this solution on Amazon public cloud.

This solution is stable. 

This solution is scalable because it provides many features.

We have received good support from the customer service and support team. They identify our problems and assist in resolving any issues we have.

Our initial setup was straightforward, and deployment by automation only took a few minutes.

I cannot comment on licensing costs and pricing as I am unsure of the exact costs.

I rate AWS WAF an eight out of ten. I would advise new customers to choose custom policies because they provide more flexibility in guarding against attacks on cloud infrastructures. Additionally, it protects both regional and global servers.

The most valuable feature of AWS WAF is the extra layer of security that I have when connecting to my web applications.

AWS WAF could improve by making the overall management easier. Many people that have started working with AWS WAF do not have an easy time. They should make it easy to use. 

The AWS WAF documentation sometimes is not clear and could improve for all levels of people using the solution, such as developers. The interface could be easier to use.

I have been using AWS WAF for approximately three years.

AWS WAF is a highly stable solution.

We have approximately 35 applications that are using the AWS WAF.

The support from AWS WAF is good, I have used them often. 

I was previously using Cisco and I switched to AWS WAF because I was working mostly with cloud environments and needed more services. Additionally, I have used Microsoft Azure.

The initial setup is AWS WAF complex. The steps to complete the implementation could be easier, such as making the web traffic go through the WAF and then through the web service. The information for connectivity could be documented or done easier. The whole process can take approximately 20 minutes.

The price of AWS WAF is expensive if you do not know how to manage your software up or down. I price of the solution is average amongst the other competitors but it would be better if it was less expensive.

My advice to others is they should give AWS WAF a try. It works well, secures the applications, and it improves them against attacks.

At the moment, it's just myself working with AWS WAF in my company, and our use case for it is normal, or what you would expect from a Web Application Firewall. That includes basic DoS blocking and malicious IP address blocking. It's not a big thing for us, and just takes care of our baseline security.

As a basic WAF, it's better than having nothing. So if you need something simple out of the box with default features, AWS WAF is good.

I think there's a lot wrong with AWS WAF. Here are the two main areas where I think it could be improved:

Blocking: We don't have much control over blocking, because the WAF is managed by AWS. What happens is that they will put down the rules on their side and we don't have proper visibility on that. So we'll have to track down the issues and see what is wrong or not. For example, with IP address blocking, it's difficult to find out which IPs are getting blocked. If we managed our own WAF completely, we wouldn't have this kind of problem. Right now, this aspect is half managed by us, and half managed by AWS. Because of this, I think it would be far more helpful to us if we went for our own tool instead.

Automation: As in, a lot of separate blocks if something goes wrong. For example, every company will have their own rules for automation, in terms of their goals for the product. Like, "I want my WAF to do this. I want my WAF to do that." But that's the kind of thing that I think we will only see when we do some POCs with our clients. 

I have been working with AWS WAF for around one year now. 

The performance has been good, even though it could be better. At any rate, the WAF has not caused any lag on our side.

It is scalable in my experience, but the lack of features doesn't take it very far in terms of actual usage. Eventually, customers will move away from it. If there's no one interested in managing the WAF, that's fine, then customers may keep using it. But for us, we are not planning to scale it out further.

AWS technical support is good.

Neutral

The setup is easy and nothing serious. You don't have to do a lot to get set up with it. Compared to other WAFs out there, I think AWS WAF is very simple, especially since most of it is managed by AWS.

We haven't needed anyone from AWS to help us with the deployment or implementation. It's all me at this point.

It's less cost and easy to setup

There are multiple other options which we could have gone for, but it depends on the budget, typically. I am especially interested in a WAF which has serious support for automation and more complex configuration options.

For people who don't have any WAF currently, and who just need something basic, it's not a bad idea to go with AWS WAF for starters. But if you are someone who is looking for a fully-fledged and self-managed WAF, you should look elsewhere for a better tool. You should certainly not stick with AWS WAF if you are serious about managing your security and mitigating your risks.

Overall, I would recommend AWS WAF to others, but only under the conditions I have mentioned. If you have the budget and the resources, however, go for something else.

I would rate AWS WAF a five out of ten.

While I cannot say for certain, I believe that we are using the latest version. 

I like the scalability, as it provides platform, infrastructure and software as a service. These are the best features. When it comes to the API Gateway, such as Amazon Web Application Framework, the web application will be protected by all industry standard security aspects. We are talking about encryption, firewalls, SSL and TLS. Basically, all web exploit policies and rules will be applied, so that one's web or mobile app can be highly secured.

In terms of hosting the instances, the solution takes care of all necessary scaling to ensure that the application load is balanced. The horizontal or vertical scaling can be automatically removed. As such, AWS provides many services and features. 

The pricing should be more affordable, especially as it pertains to small clients. 

While the complexity of the installation can vary from one service to another, overall, I would say that it and the configuration and navigation are somewhat complex. These could stand improvement and bring down my rating of the product. 

Customer support should also be improved. 

I have been using AWS WAF for around two years. 

The solution is stable. 

The solution is scalable. 

While it can vary according to the service involved, installation, configuration and navigation are, broadly speaking, complex. 

The solution could be more cost-efficient for small customers. 

The solution may be expensive for smaller customers and vendors, although it would be recommended for large ones who can afford it. 

Our organization has only a few years, consisting of the internal team, who are making use of the solution. 

I rate AWS WAF as a six out of ten. 

We use the solution for our applications. We have deployed multiple applications on the AWS platform. We use the tool to provide additional security to our applications.

The product’s availability, ease of configuration, and documentation are valuable.

The product has fewer features. It didn’t fulfill all our requirements when we installed it. It is getting better now, though. The product must provide more features.

I have been using the solution for a few years.

I rate the product’s stability a nine out of ten.

The product is highly scalable and highly available. I rate the scalability a nine out of ten. We have deployed three applications. We have two administrators for our infrastructure. The number of users varies according to our customers. We provide the user interface to our customers.

The technical support team is good. The support persons provide prompt responses. They are always available and provide solutions to our queries.

Positive

The setup is very easy. We have proper documentation, so we have no issues. We have deployed the tool for additional security. It is a cloud solution. We need two members from the cloud infrastructure team and eight from the application support team for the deployment and maintenance of the tool.

We deploy the tool ourselves.

The solution provides an additional layer of security.

The solution is affordable.

If a company needs an additional layer of security, it can use AWS WAF. I recommend the product to others. Overall, I rate the product a ten out of ten.

We use AWS WAF to protect internet system applications. 

The most valuable feature of the solution is the ability to integrate central sets. It protects from intrusion attacks such as scripting and SQL injections. 

We should be able to do proper whitelisting. 

I have been working with the solution for four years. 

AWS WAF is stable. 

My company has more than 10,000 users. The tool is scalable. 

AWS WAF's tech support is not complicated. 

Positive

AWS WAF's deployment is easy. 

We have seen ROI with the tool's use.

AWS WAF has reasonable pricing. 

You need to consider the use cases before implementing the solution. I rate it a ten out of ten. 

One common use case is using detection protection for enhancing security models in AWS. Another use case is implementing log analysis and response recovery procedures for email services.

I believe there is a need to move towards real-time analysis with the help of AI and intelligent systems in the future. This would reduce the reliance on manual work and enhance the functionality of detection protection. By incorporating AI-driven data analysis and data science techniques, we can improve the solution's user-friendliness, security compatibility, and accuracy.

I have been using the solution for almost a decade.

AWS WAF is stable. 

The solution is scalable.

The initial setup was easy.

Our in-house engineers implemented the solution. They are already familiar with AWS and hold AWS certifications.

Overall, I rate the solution an eight out of ten.

We are an AWS service provider and we use the solution for the cloud and to provide service to other users.

The stability of AWS WAF is valuable.

The cost management has room for improvement.

I have been using the solution for eight years.

I give the stability a ten out of ten.

I give the scalability a nine out of ten.

The technical support is helpful.

The price is average.

I give the solution a ten out of ten.

The solution is a public cloud platform and we have millions of users.