Skip to main content
AWS WAF can log every request that hits a web ACL — including the rule that matched, the action taken (allow, block, count, captcha), the source IP, and the request headers. The logs are the foundation for security analytics and rule tuning. S3 Log Forwarder — configure logging on each web ACL with an S3 destination, then point the Bronto forwarder Lambda at the bucket.

​
Alternatives

  • Kinesis Firehose — for very high request volumes. WAF delivers logs directly to Firehose as native JSON, so Bronto flattens them into searchable fields automatically (action, httpRequest.clientIp, terminatingRuleId, …) — no parser needed.
    AWS requires the Firehose delivery stream name to start with aws-waf-logs- before WAF will allow it as a logging destination.
  • CloudWatch Log Forwarder — when logs are routed to a CloudWatch Log Group instead.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References