> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS WAF

> Run an OpenTelemetry Collector that reads your aws-waf-logs- CloudWatch log groups and forwards AWS WAF web ACL logs to Sazabi.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

Run your own OpenTelemetry Collector to forward AWS WAF logs without granting Sazabi a cross-account IAM role. The Collector's `awscloudwatch` receiver picks up every log group whose name starts with `aws-waf-logs-` and exports OTLP to your Sazabi intake URL. Your AWS credentials stay with the Collector.

To have Sazabi set up subscription filters for you instead, see [AWS WAF (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-waf.md).

## Prerequisites

* Each web ACL logs to a CloudWatch Logs log group named `aws-waf-logs-…`. In the AWS WAF console, open the web ACL, go to **Logging and metrics**, and pick a CloudWatch Logs log group as the destination. CloudFront web ACLs log in us-east-1.
* An AWS identity for the Collector with `logs:DescribeLogGroups`, `logs:FilterLogEvents`, and `logs:GetLogEvents` on those log groups.

## Set up in the dashboard

**Step 1**

### Get your intake URL

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, select **AWS WAF**, and choose the endpoint setup. Copy the collector configuration; it already contains your intake URL.

**Step 2**

### Configure the Collector

The generated configuration looks like this, with your project's region and intake host filled in:

```yaml theme={"system"}
receivers:
  awscloudwatch:
    region: us-east-1
    logs:
      poll_interval: 1m
      groups:
        autodiscover:
          prefix: aws-waf-logs-

exporters:
  otlphttp:
    logs_endpoint: https://<your-intake-host>/v1/logs

service:
  pipelines:
    logs:
      receivers: [awscloudwatch]
      exporters: [otlphttp]
```

Use the `opentelemetry-collector-contrib` distribution; the `awscloudwatch` receiver ships there. The key is embedded in the endpoint hostname, so no auth header is needed.

**Step 3**

### Deploy the Collector

Run the Collector anywhere with AWS credentials from the standard SDK chain (environment variables, an instance or task role, or a named profile).

## Set up with the CLI

Create the source and print the generated collector configuration with the [Sazabi CLI](https://docs.sazabi.com/reference/cli/log-sources.md):

```bash theme={"system"}
sazabi log-sources setup-instructions aws_waf    # Setup steps, including the endpoint path
sazabi log-sources list --provider aws_waf       # Find the AWS WAF log source ID
```

## Verify

Send a request through the web ACL, then open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm records attributed to the **AWS WAF** source appear. The Collector polls once a minute, so allow a few minutes.

## Troubleshooting

**No records arrive** — Check the Collector logs for `AccessDenied` from CloudWatch Logs or export errors, and confirm the log groups are in the region the receiver reads.

**Only some web ACLs appear** — Every log group must start with `aws-waf-logs-`; AWS WAF rejects other names as logging destinations.

## Further reading

> [card] [AWS WAF (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-waf.md)
>
> Let Sazabi set up subscription filters on your WAF log groups.

> [card] [AWS WAF logging](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html)
>
> AWS documentation for web ACL logging destinations and fields.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.