AWS WAF & Shield Support
AWS WAF logging setup and cost control.
WAF logs are how you tune rules and investigate attacks, but they can be large and may contain sensitive data. We pick the right destination, filter to what matters, redact secrets and explain what your WAF bill is made of before it surprises you.
When You Need This
The situations where this work pays for itself.
Signs it is time
- You need to see which rule blocked a request
- WAF cost is higher than expected and you cannot tell why
- Logs may contain tokens, cookies or personal data
- You want dashboards of blocked requests and top attackers
- A security review requires retained web request logs
What you get
- WAF logging with redaction and filters in infrastructure as code
- Athena or Logs Insights queries for tuning and investigations
- A cost breakdown by WAF component
- Retention rules that match your policy
How we do it
A clear, safe process you can follow along with.
1. Choose a destination
S3 is the cheapest for retention and Athena analysis. CloudWatch Logs suits interactive Logs Insights and alarms. Firehose lets you route to a SIEM. The resource name must start with aws-waf-logs-.
2. Redact sensitive fields
We redact the Authorization header, cookies, and sensitive query parameters or body fields before they are written, so logs do not become a store of credentials.
3. Apply a logging filter
On busy sites we log blocked, counted and challenged requests fully, and sample or drop the allowed ones, which are typically most of the volume.
4. Understand what is billed
WAF charges include the web ACL, each rule, and requests inspected, with additional charges for some managed groups such as Bot Control and for inspection of large bodies. Logging adds its destination's ingestion and storage cost. We check current pricing for your setup.
5. Build queries
We create an Athena table over the S3 logs, or Logs Insights queries, to report top blocked rules, source countries, URIs and false positive candidates.
6. Set retention and review cost
We add S3 lifecycle rules or log retention, remove unneeded rules and groups, and review the bill by component each month.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Logging cookies and authorization headers
They may contain session tokens. Redact them.
CloudWatch Logs for everything
High volume can be expensive there. S3 plus Athena is usually cheaper.
Too many overlapping managed rule groups
Each adds cost and evaluation capacity use. Keep what you need.
No retention policy
Logs grow forever unless limited.
Frequently Asked Questions
Where can AWS WAF send logs?
To an S3 bucket, a CloudWatch Logs log group or a Kinesis Data Firehose delivery stream, each with a name beginning with aws-waf-logs-.
How is AWS WAF priced?
You pay for web ACLs, rules and the requests inspected, with extra fees for certain managed rule groups and features. Check the current pricing page for exact rates.
Can I hide sensitive data in WAF logs?
Yes. You can redact specific fields such as headers, query strings and URI paths before logs are delivered.
Want Help With AWS WAF logging setup and cost control?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required