AWS waf: Added note on WAF metrics behavior for empty web ACLs
Summary
Clarifies that AWS WAF won't provide sampled requests or CloudWatch metrics for Application Load Balancers with empty web ACLs and links to DDoS prevention docs.
Security assessment
The change documents observability limitations and links to DDoS prevention guidance, adding security best-practice documentation.
Evidence
If your Application Load Balancer is associated with a protection pack (web ACL) that has no rules or other active configurations, AWS WAF does not provide sampled requests or publish CloudWatch metrics for that Application Load Balancer. For more information about this behavior and how to enable observability features, see [AWS WAF Distributed Denial of Service (DDoS) prevention](./waf-anti-ddos.html).
Diff
diff --git a/waf/latest/developerguide/waf-metrics.md b/waf/latest/developerguide/waf-metrics.md index 4c1e82e1e..91b3a5b15 100644 --- a//waf/latest/developerguide/waf-metrics.md +++ b//waf/latest/developerguide/waf-metrics.md @@ -20,0 +21,4 @@ You can see the following metrics for protection packs (web ACLs), rules, rule g +###### Note + +If your Application Load Balancer is associated with a protection pack (web ACL) that has no rules or other active configurations, AWS WAF does not provide sampled requests or publish CloudWatch metrics for that Application Load Balancer. For more information about this behavior and how to enable observability features, see [AWS WAF Distributed Denial of Service (DDoS) prevention](./waf-anti-ddos.html). +