This is a field that stores executed actions if requests are blocked by AWS WAF, “waf” will be the last action.

Important information to look for in the access logs when requests are blocked by AWS WAF is the actions_executed field. Format of Application Load Balancer's access logs Resources attached to AWS WAF will respond, so there will be no information left for the access logs in the web server.ĪWS WAF rule action 3. When requests are blocked by AWS WAF, HTTP status 403 (Forbidden) is returned.

What happens when access is blocked by AWS WAF If you are simply looking at blocked IP addresses or the number of blocked requests, access logs can provide that information.Ģ. You can see if access was blocked by AWS WAF by looking at WAF logs, but the format is a bit more complicated compared to access logs. We will take a look at a way to check the blocking status of AWS WAF in Application Load Balancer’s access logs in this post. This post was originally published in Japanese in the past.

Waf load balancer