IaC Bazaar
Browse modules
Menu
AWSLive-testedattested

WAFv2 Web ACL (managed rules + rate limit)

A WAFv2 web ACL (REGIONAL or CLOUDFRONT) with a default-allow posture, configurable AWS managed rule groups blocking by default, and a rate-based rule that throttles abusive IPs.

terraformAWSaws

Compare WAF & Edge Security across clouds →

Part of: AWS Production Landing Zone

aws-wafvizier v1.2.0

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-30 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o aws-waf-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/aws-waf/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle aws-waf-1.0.0.sigstore.json \
  aws-waf-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "cc30594db863d2426917a75c5dec3e24b292cc3e3cff93f3a2803221104a7001  aws-waf-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "waf" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-waf/aws"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.

README.md, GitLab, Gitea
[![IaC Bazaar: live-tested](https://www.iac-bazaar.com/api/artifacts/aws-waf/badge)](https://www.iac-bazaar.com/catalog/aws-waf?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, live-tested on IaC Bazaar: [WAFv2 Web ACL (managed rules + rate limit)](https://www.iac-bazaar.com/catalog/aws-waf?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "waf" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-waf/aws"
  version = "1.0.0"
}
```

Preview:IaC Bazaar: live-tested

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

aws-waf

AWS WAFv2 web ACL (REGIONAL or CLOUDFRONT scope) with a default-allow posture, a configurable set of AWS managed rule groups (blocking by default), and an optional rate-based rule that throttles abusive IPs. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

The two classic WAFv2 gotchas are handled for you: managed rule groups attach via override_action (not action) so the group's own blocking decisions apply, and the web ACL ships with the required visibility_config on the ACL and every rule.

Secure defaults:

  • Default action allow (the standard posture: pass normal traffic, let rules block the bad) — flip to block for an allow-list-only edge.
  • Managed rule groups run active/blocking (override_action { none {} }), not count-only. Set override_to_count = true per group to observe before enforcing.
  • A rate-based rule is enabled by default and blocks any IP exceeding rate_limit requests (2000) per 5-minute window.
  • CloudWatch metrics + request sampling on, so you can tune false positives.

Scope note: CLOUDFRONT-scope web ACLs must be created with the AWS provider configured for us-east-1. REGIONAL ACLs live in (and protect resources in) the provider's region. Resource associations apply to REGIONAL only — CloudFront attaches a web ACL through its distribution's web_acl_id.

Requirements

  • Terraform or OpenTofu >= 1.6
  • hashicorp/aws >= 6.0, < 7.0

Security notes

  • Managed rule groups are blocking by default. When introducing a new group to production traffic, set override_to_count = true first, watch the CloudWatch CountedRequests/sampled requests, then switch it to enforcing.
  • Full WAF traffic logging is built in but opt-in: pass the ARN of a Kinesis Data Firehose, S3 bucket, or CloudWatch log group whose name starts with the mandatory aws-waf-logs- prefix via log_destination_configs. authorization and cookie request headers are redacted from logs by default (log_redacted_headers).
  • Keep default_action = "allow"; only use block when you intend an allow-list-only edge driven entirely by explicit allow rules.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
  • Inputs
  • Outputs
Create a free accountSign in

Related modules

Static validatedLive test pending

aws-verified-permissions

validation_settings.mode defaults to OFF, so a Cedar policy naming an action the schema does not define is accepted and then never matches. A broken permit fails closed and somebody complains; a broken forbid fails OPEN and nobody does. STRICT here, with the schema that makes it possible.

View module
Static validatedLive test pending

aws-rolesanywhere

Any certificate chaining to the trust anchor can exchange itself for AWS credentials, so the CA is the perimeter - and it is usually run by people who were never told. The profile carries the scope, sessions are narrowed below the role, the caller cannot name itself in CloudTrail, and CA expiry warns before every workload loses credentials at once.

View module
Static validatedLive test pending

aws-signer

Signing profiles for Lambda packages and container images, plus the code signing configuration that enforces them. Defaults to Enforce rather than the API default Warn, which logs an untrusted artifact and deploys it anyway.

View module
Live-tested

aws-cognito

A secure-by-default Cognito user pool and app client with optional hosted-UI domain - strong password policy, TOTP MFA, account-enumeration protection, SRP-only flows, and refresh-token revocation.

View module
Static validatedLive test pending

aws-conformance-packs

AWS Config conformance packs for one account or a whole organisation, with a ten-rule baseline of AWS managed rules taken from AWS's CIS sample pack. AWS Audit Manager no longer takes new customers and points them here. The module says a pack evaluates nothing without a configuration recorder and that Terraform cannot detect a pack edited in the console.

View module
Static validatedLive test pending

aws-lake-formation

AWS Lake Formation with its own permissions switched on for new databases and tables: admins, registered S3 locations and explicit grants. AWS ships it in IAM-only mode, and its settings resource clears any admin it is not given, so admins are required and the settings are protected from destroy. Existing databases keep IAM-only access until revoked outside Terraform, and it says so.

View module