Skip to main content
All AWS integration capabilities

​
About

AWS WAF logs every request a web ACL inspects: the action it took (allow, block, count, CAPTCHA, or challenge), the rule that decided it, rate-based rule matches, labels, and the request’s client IP, country, URI, and headers. Send those logs to a CloudWatch Logs log group, connect your AWS account, and Sazabi sets up a CloudWatch subscription filter on each WAF log group you select. It uses the same cross-account IAM role and pipeline as the CloudWatch log source. AWS WAF also has a Send to an endpoint path where you run your own OpenTelemetry Collector against the WAF log groups. See AWS WAF endpoint page for that setup.

​
Prerequisites

  • An AWS account with permission to create an IAM role (iam:CreateRole, iam:PutRolePolicy).
  • Permission to turn on web ACL logging: wafv2:PutLoggingConfiguration, logs:CreateLogDelivery, logs:DeleteLogDelivery, logs:PutResourcePolicy, logs:DescribeResourcePolicies, and logs:DescribeLogGroups.
  • A Sazabi project in the web ACL’s logging region. CloudFront web ACLs log in us-east-1; regional web ACLs log in their own region.

​
Set up in the dashboard

1

​
Send web ACL logs to CloudWatch Logs

In the AWS WAF console, open each web ACL, go to Logging and metrics, and choose Enable (or Edit). Pick CloudWatch Logs log group as the destination and select or create a log group whose name starts with aws-waf-logs-. AWS WAF adds the log delivery resource policy for you.AWS WAF allows one logging destination per web ACL, so a web ACL that logs to S3 or Firehose today stops doing so. CloudWatch Logs bills every logged request; add a logging filter (for example, keep only blocked and counted requests) to limit volume.
2

​
Create the IAM role

Go to Settings > Log streams, click Add source, and select AWS WAF. Choose CloudFormation, Terraform, or the AWS CLI. All three create the same role the CloudWatch log source uses; if your project already has that role, you can reuse it.The IAM role grants Sazabi permission to:
  • logs:DescribeLogGroups — list your WAF log groups
  • logs:DescribeSubscriptionFilters — inspect existing filters
  • logs:PutSubscriptionFilter and logs:DeleteSubscriptionFilter — install and remove filters
  • logs:PutAccountPolicy, logs:DeleteAccountPolicy, logs:DescribeAccountPolicies — manage account-level policies
3

​
Enter the role ARN

Paste the role ARN into the dashboard and click Connect. Sazabi validates that it can assume the role using the external ID generated for your project.
4

​
Add log streams

Click Add log stream to open the log group picker. It lists only log groups whose names start with aws-waf-logs-, in your project’s region. Select the web ACLs’ log groups; Sazabi installs a subscription filter on each one.

​
Set up with the CLI

The initial native connection is best created in the dashboard, because the IAM role’s trust policy must reference a Sazabi-generated external ID. You can turn on web ACL logging and manage the source from a terminal:

​
Verify

Send a request through a connected web ACL. Open the Intake page in the Sazabi dashboard and confirm that records attributed to the AWS WAF source appear. Each record’s body is the WAF log entry, with fields such as action, terminatingRuleId, httpRequest.clientIp, and webaclId.

​
Troubleshooting

No log groups in the picker — The web ACL has no CloudWatch Logs destination yet, the log group name lacks the aws-waf-logs- prefix, or the log group is in a different region than your Sazabi project. WAFLogDestinationPermissionIssueException when enabling logging — Your AWS identity lacks logs:CreateLogDelivery or logs:PutResourcePolicy, or the account has reached its CloudWatch Logs resource policy limit. “Subscription filter quota exceeded” — CloudWatch allows two subscription filters per log group. Remove an existing filter before re-adding the log stream. Logs stop arriving — Check that the web ACL’s logging configuration, the log group, and the IAM role still exist.

​
Further reading

AWS WAF (send to an endpoint)

Run your own OpenTelemetry Collector against the WAF log groups.

AWS WAF logging

AWS documentation for web ACL logging destinations and fields.