AWS WAF Classic

aws Web application firewallaws-waf-classic

Previous-generation AWS WAF web ACL of match conditions and rules; end of support 7 October 2026.

Provider: aws
Kind: Web application firewall
Category: Security
Official docs: https://docs.aws.amazon.com/waf/latest/developerguide/classic-waf-chapter.html

Properties · 4 set by this component

property	type	values	required	kind default	this component
botProtection	boolean	—	no	—	▸ false
customRuleCount	integer	—	no	—	inherited
defaultAction · component property	enum	allow \| block	no	—	inherited
logging · component property	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ true
managedRuleSet	string	—	no	—	inherited
mode	enum	detection \| prevention \| off	no	—	▸ prevention
protectedResource · component property	enum	cloudfront \| application-load-balancer \| api-gateway	no	—	inherited
rateBasedRuleWindowMinutes · component property	integer	—	no	5	inherited
rateLimiting	boolean	—	no	—	▸ false

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "waf-classic", component: "aws-waf-classic" }

Other Web application firewall products · 13

Web Application Firewallalibaba-wafalibabacloudwaf AWS WAF web ACLaws-wafawswaf Azure Web Application Firewallazure-web-application-firewallazurewaf Firewall for AIcloudflare-firewall-for-aicloudflarewaf Cloudflare WAFcloudflare-wafcloudflarewaf Corazacorazawaf Imperva Application Securityimpervawaf ModSecuritymodsecuritywaf NAXSInaxsiwaf Generic web application firewallwafwaf Google Cloud Armorgoogle-cloud-armorgcpwaf reCAPTCHA Enterprisegoogle-recaptcha-enterprisegcpwaf Web Application Firewalloci-wafociwaf

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# AWS WAF Classic: the pre-November-2019 AWS WAF, a web ACL of conditions and rules in front of a
3# CloudFront distribution, Application Load Balancer or API Gateway REST API ("AWS WAF Classic").
4# The web ACL default action is allow or block and rate-based rules count requests over a 5-minute
5# period ("Creating and configuring a Web Access Control List (Web ACL)").
6# Sunset: end of support 7 October 2026 (AWS service lifecycle, sunset services); placeable until then.
7schemaVersion: "1"
8type: "component"
9id: "aws-waf-classic"
10kind: "waf"
11provider: "aws"
12docs: "https://docs.aws.amazon.com/waf/latest/developerguide/classic-waf-chapter.html"
13defaults:
14  managed: true
15  mode: "prevention"
16  botProtection: false
17  rateLimiting: false
18properties:
19  defaultAction:
20    type: "enum"
21    values: ["allow", "block"]
22  protectedResource:
23    type: "enum"
24    values: ["cloudfront", "application-load-balancer", "api-gateway"]
25  rateBasedRuleWindowMinutes:
26    type: "integer"
27    default: 5
28  logging:
29    type: "boolean"
30    default: false

The same page as markdown, for an agent: /catalogue/components/aws-waf-classic.md