> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS WAF

> Connect your AWS account so Sazabi sets up subscription filters on your AWS WAF log groups and streams web ACL logs in real time.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

AWS WAF logs every request a web ACL inspects: the action it took (allow, block, count, CAPTCHA, or challenge), the rule that decided it, rate-based rule matches, labels, and the request's client IP, country, URI, and headers. Send those logs to a CloudWatch Logs log group, connect your AWS account, and Sazabi sets up a CloudWatch subscription filter on each WAF log group you select. It uses the same cross-account IAM role and pipeline as the [CloudWatch log source](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudwatch.md).

AWS WAF also has a **Send to an endpoint** path where you run your own OpenTelemetry Collector against the WAF log groups. See [AWS WAF endpoint page](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-waf.md) for that setup.

## Prerequisites

* An AWS account with permission to create an IAM role (`iam:CreateRole`, `iam:PutRolePolicy`).
* Permission to turn on web ACL logging: `wafv2:PutLoggingConfiguration`, `logs:CreateLogDelivery`, `logs:DeleteLogDelivery`, `logs:PutResourcePolicy`, `logs:DescribeResourcePolicies`, and `logs:DescribeLogGroups`.
* A Sazabi project in the web ACL's logging region. CloudFront web ACLs log in us-east-1; regional web ACLs log in their own region.

## Set up in the dashboard

**Step 1**

### Send web ACL logs to CloudWatch Logs

In the AWS WAF console, open each web ACL, go to **Logging and metrics**, and choose **Enable** (or **Edit**). Pick **CloudWatch Logs log group** as the destination and select or create a log group whose name starts with `aws-waf-logs-`. AWS WAF adds the log delivery resource policy for you.

AWS WAF allows one logging destination per web ACL, so a web ACL that logs to S3 or Firehose today stops doing so. CloudWatch Logs bills every logged request; add a logging filter (for example, keep only blocked and counted requests) to limit volume.

**Step 2**

### Create the IAM role

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, and select **AWS WAF**. Choose CloudFormation, Terraform, or the AWS CLI. All three create the same role the CloudWatch log source uses; if your project already has that role, you can reuse it.

The IAM role grants Sazabi permission to:

* `logs:DescribeLogGroups` — list your WAF log groups
* `logs:DescribeSubscriptionFilters` — inspect existing filters
* `logs:PutSubscriptionFilter` and `logs:DeleteSubscriptionFilter` — install and remove filters
* `logs:PutAccountPolicy`, `logs:DeleteAccountPolicy`, `logs:DescribeAccountPolicies` — manage account-level policies

**Step 3**

### Enter the role ARN

Paste the role ARN into the dashboard and click **Connect**. Sazabi validates that it can assume the role using the external ID generated for your project.

**Step 4**

### Add log streams

Click **Add log stream** to open the log group picker. It lists only log groups whose names start with `aws-waf-logs-`, in your project's region. Select the web ACLs' log groups; Sazabi installs a subscription filter on each one.

## Set up with the CLI

The initial native connection is best created in the dashboard, because the IAM role's trust policy must reference a Sazabi-generated external ID. You can turn on web ACL logging and manage the source from a terminal:

```bash theme={"system"}
aws logs create-log-group --log-group-name aws-waf-logs-my-web-acl
aws wafv2 put-logging-configuration --logging-configuration \
  "ResourceArn=<web-acl-arn>,LogDestinationConfigs=<log-group-arn>"

sazabi log-sources list --provider aws_waf    # Find the AWS WAF log source ID
sazabi log-sources get <log-source-id>        # Log source details and its log streams
```

## Verify

Send a request through a connected web ACL. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm that records attributed to the **AWS WAF** source appear. Each record's body is the WAF log entry, with fields such as `action`, `terminatingRuleId`, `httpRequest.clientIp`, and `webaclId`.

## Troubleshooting

**No log groups in the picker** — The web ACL has no CloudWatch Logs destination yet, the log group name lacks the `aws-waf-logs-` prefix, or the log group is in a different region than your Sazabi project.

**`WAFLogDestinationPermissionIssueException` when enabling logging** — Your AWS identity lacks `logs:CreateLogDelivery` or `logs:PutResourcePolicy`, or the account has reached its CloudWatch Logs resource policy limit.

**"Subscription filter quota exceeded"** — CloudWatch allows two subscription filters per log group. Remove an existing filter before re-adding the log stream.

**Logs stop arriving** — Check that the web ACL's logging configuration, the log group, and the IAM role still exist.

## Further reading

> [card] [AWS WAF (send to an endpoint)](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-waf.md)
>
> Run your own OpenTelemetry Collector against the WAF log groups.

> [card] [AWS WAF logging](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html)
>
> AWS documentation for web ACL logging destinations and fields.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.