# Use Amazon WAF to protect your REST APIs in API Gateway
<a name="apigateway-control-access-aws-waf"></a>

Amazon WAF is a web application firewall that helps protect web applications and APIs from attacks. It enables you to configure a set of rules called a web access control list (web ACL) that allow, block, or count web requests based on customizable web security rules and conditions that you define. For more information, see [How Amazon WAF Works](https://docs.amazonaws.cn/waf/latest/developerguide/how-aws-waf-works.html).

You can use Amazon WAF to protect your API Gateway REST API from common web exploits, such as SQL injection and cross-site scripting (XSS) attacks. These could affect API availability and performance, compromise security, or consume excessive resources. For example, you can create rules to allow or block requests from specified IP address ranges, requests from CIDR blocks, requests that originate from a specific country or region, requests that contain malicious SQL code, or requests that contain malicious script. 

You can also create rules that match a specified string or a regular expression pattern in HTTP headers, method, query string, URI, and the request body (limited to the first 64 KB). Additionally, you can create rules to block attacks from specific user agents, bad bots, and content scrapers. For example, you can use rate-based rules to specify the number of web requests that are allowed by each client IP in a trailing, continuously updated, 5-minute period. 

**Important**  
Amazon WAF is your first line of defense against web exploits. When Amazon WAF is enabled on an API, Amazon WAF rules are evaluated before other access control features, such as [resource policies](apigateway-resource-policies.md), [IAM policies](permissions.md), [Lambda authorizers](apigateway-use-lambda-authorizer.md), and [Amazon Cognito authorizers](apigateway-integrate-with-cognito.md). For example, if Amazon WAF blocks access from a CIDR block that a resource policy allows, Amazon WAF takes precedence and the resource policy isn't evaluated.

To enable Amazon WAF for your API, you need to do the following:

1. Use the Amazon WAF console, Amazon SDK, or CLI to create a web ACL that contains the desired combination of Amazon WAF managed rules and your own custom rules. For more information, see [Getting Started with Amazon WAF](https://docs.amazonaws.cn/waf/latest/developerguide/getting-started.html) and [Web access control lists (web ACLs)](https://docs.amazonaws.cn/waf/latest/developerguide/web-acl.html).
**Important**  
API Gateway requires an Amazon WAFV2 web ACL for a Regional application or an Amazon WAF Classic Regional web ACL.

1. Associate the Amazon WAF web ACL with an API stage. You can do this by using the Amazon WAF console, Amazon SDK, CLI, or by using the API Gateway console.

## To associate an Amazon WAF web ACL with an API Gateway API stage using the API Gateway console
<a name="apigateway-control-access-aws-waf-console"></a>

To use the API Gateway console to associate an Amazon WAF web ACL with an existing API Gateway API stage, use the following steps:

1. Sign in to the API Gateway console at [https://console.amazonaws.cn/apigateway](https://console.amazonaws.cn/apigateway).

1. Choose an existing API or create a new one.

1. In the main navigation pane, choose **Stages**, and then choose a stage.

1. In the **Stage details** section, choose **Edit**.

1. Under **Web application firewall (Amazon WAF)**, select your web ACL.

   If you are using Amazon WAFV2, select an Amazon WAFV2 web ACL for a Regional application. The web ACL and any other Amazon WAFV2 resources that it uses must be located in the same Region as your API.

   If you are using Amazon WAF Classic Regional, select a Regional web ACL.

1. Choose **Save changes**.

## Associate an Amazon WAF web ACL with an API Gateway API stage using the Amazon CLI
<a name="apigateway-control-access-aws-waf-awscli"></a>

The following [associate-web-acl](https://docs.amazonaws.cn/cli/latest/reference/wafv2/associate-web-acl.html) command associates an Amazon WAFV2 web ACL for a Regional application with an existing API Gateway API stage:

```
aws wafv2 associate-web-acl \
--web-acl-arn  arn:aws:wafv2:{{{region}}}:{{111122223333}}:regional/webacl/test-cli/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 \
--resource-arn arn:aws:apigateway:{{{region}}}::/restapis/4wk1k4onj3/stages/prod
```

The following [associate-web-acl](https://docs.amazonaws.cn/cli/latest/reference/waf-regional/associate-web-acl.html) command associates an Amazon WAF Classic Regional web ACL with an existing API Gateway API stage:

```
aws waf-regional associate-web-acl \
--web-acl-id 'aabc123a-fb4f-4fc6-becb-2b00831cadcf' \
--resource-arn 'arn:aws:apigateway:{{{region}}}::/restapis/4wk1k4onj3/stages/prod'
```

## Associate an Amazon WAF web ACL with an API stage using the Amazon WAF REST API
<a name="apigateway-control-access-aws-waf-api"></a>

To use the Amazon WAFV2 REST API to associate an Amazon WAFV2 web ACL for a Regional application with an existing API Gateway API stage, use the [AssociateWebACL](https://docs.amazonaws.cn/waf/latest/APIReference/API_AssociateWebACL.html) command, as in the following example:

```
import boto3
 
wafv2 = boto3.client('wafv2')

wafv2.associate_web_acl(
    WebACLArn='arn:aws:wafv2:{{{region}}}:{{111122223333}}:regional/webacl/test/abc6aa3b-fc33-4841-b3db-0ef3d3825b25',
    ResourceArn='arn:aws:apigateway:{{{region}}}::/restapis/4wk1k4onj3/stages/prod'
)
```

To use the Amazon WAF REST API to associate an Amazon WAF Classic Regional web ACL with an existing API Gateway API stage, use the [AssociateWebACL](https://docs.amazonaws.cn/waf/latest/APIReference/API_wafRegional_AssociateWebACL.html) command, as in the following example:

```
import boto3
 
waf = boto3.client('waf-regional')
 
waf.associate_web_acl(
    WebACLId='aabc123a-fb4f-4fc6-becb-2b00831cadcf',
    ResourceArn='arn:aws:apigateway:{{{region}}}::/restapis/4wk1k4onj3/stages/prod'
)
```