WAF blocks SQL injection, XSS, and bot traffic at the application layer. A defense-in-depth layer.

ModSecurity + OWASP CRS¶

WAF Configuration — Web Application Firewall¶

modsecurity on; modsecurity_rules_file /etc/modsecurity/crs/crs-setup.conf; modsecurity_rules_file /etc/modsecurity/crs/rules/*.conf;

AWS WAF¶

resource “aws_wafv2_web_acl” “main” { default_action { allow {} } rule { name = “aws-managed” statement { managed_rule_group_statement { vendor_name = “AWS” name = “AWSManagedRulesCommonRuleSet” } } } }

Key Takeaway¶

WAF is defense-in-depth, not a replacement for secure code. Start with managed rules.