Story perspectives

Adjusting AWS WAF to Balance DDoS Protection and Usability

11/6/2025

39 7

Summary

Story summary

The AWS WAF Anti-DDoS managed rule group configuration challenges legitimate users during DDoS events.
To improve user experience, adjustments can be made to the ChallengeAllDuringEvent rule.
One option is permitting non-suspicious requests without challenge.
However, these adjustments may lead to a large number of non-challengeable requests, especially at sensitive endpoints, and require special consideration for form submissions and API requests to balance protection and usability.

1 of 1

Story summary

The AWS WAF Anti-DDoS managed rule group configuration challenges legitimate users during DDoS events.
To improve user experience, adjustments can be made to the ChallengeAllDuringEvent rule.
One option is permitting non-suspicious requests without challenge.
However, these adjustments may lead to a large number of non-challengeable requests, especially at sensitive endpoints, and require special consideration for form submissions and API requests to balance protection and usability.