AWS WAF Logs: Verify Filtering and Data Protection

AWS WAF logs help explain which rules evaluated a request and what action followed. The dataset can be intentionally filtered, and request fields can be protected through different controls. Investigating a missing request or exposed field requires knowing which collection path is being examined: delivered logs, request samples or another configured destination.

Record the web ACL ARN, scope, associated resource, logging destination, filter configuration, redacted fields and data-protection settings. Use synthetic requests containing clearly fake marker values. Do not test sensitive-field handling by sending a real password or customer identifier.

Define what evidence the security team needs. Keeping only blocked traffic may suit one investigation but prevents analysis of allowed requests. Document that tradeoff before narrowing the dataset to reduce storage.

Inspect the logging filter's default behavior and its conditions. AWS supports filtering on actions and labels. A default DROP combined with selective keep rules can correctly omit most traffic, even while WAF metrics show those requests were evaluated.

Send a controlled request expected to match a retained category and another expected to be dropped. Record timestamps and non-sensitive markers. Compare rule evaluation and action with the configured logging conditions before attributing the difference to a broken destination.

Inspect redaction against the actual request component and rule match settings. AWS documents specific supported fields and notes that single-header redaction is not equivalent to rules matching the broader headers component. Verify the resulting record rather than assuming a similarly named setting protects every representation.

Logging redaction does not control request sampling. If the requirement includes sampled-request protection, review web ACL data protection or sampling configuration. Treat the privacy requirement as a collection-wide contract and identify each path to which a setting applies.

An explicitly illustrative scenario: a support team searches delivered logs for a successful request during a login investigation. The web ACL keeps only blocked traffic, so the successful request was intentionally dropped. During the same review, the team finds that logging redaction had been mistaken for sampling protection. It updates the evidence-retention and data-protection design using synthetic markers, then verifies both collection paths.

Apply the reviewed filter or protection adjustment through the normal security change workflow. Repeat the kept and dropped test cases and inspect the actual destination records. Verify that the required diagnostic fields remain useful while fake sensitive markers are handled as intended.

The SOP should name the logging owner, retained traffic categories, field-protection scope, retention period and access controls for analysts. Monitor unexpected log-volume changes together with WAF traffic metrics so a filter update is distinguishable from delivery failure. Revalidate protection after new rules match different request components or a team enables another collection destination.

Explore Clouvenix cloud security for implementation and operational handover.

Technical reference

WAF data protection and logging, logging configuration, and logging filters define collection boundaries.