Skip to main content
AWS WAF can log every request that a protection pack (web ACL) evaluates — including the rule that matched, the action taken (allow, block, count, captcha, challenge), the source IP, and the request headers. The logs are the foundation for security analytics and rule tuning.
Every WAF logging destination must have a name that starts with aws-waf-logs-. This applies to S3 buckets, CloudWatch Logs log groups, and Amazon Data Firehose streams.
S3 Log Forwarder — configure logging on each protection pack (web ACL) with an S3 destination (bucket name starting with aws-waf-logs-), then point the Bronto forwarder Lambda at the bucket.

​
Alternatives

  • Amazon Data Firehose — for very high request volumes. WAF delivers logs directly to Firehose as native JSON, so Bronto flattens them into searchable fields automatically (action, httpRequest.clientIp, terminatingRuleId, …) — no parser needed.
    Create the Firehose stream with these settings, or WAF won’t accept it as a logging destination:
    • Name starts with aws-waf-logs-.
    • Source is Direct PUT or other sources, not a Kinesis data stream.
    • Same account and Region as the protection pack (web ACL). For CloudFront protection packs, use US East (N. Virginia), us-east-1.
  • CloudWatch Log Forwarder — when logs are routed to a CloudWatch Log Group instead.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References