> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS WAF Logs

> Ingest AWS WAF web ACL traffic logs — allowed, blocked, and counted requests with rule match details — into Bronto for security monitoring and threat hunting.

AWS WAF can log every request that hits a web ACL — including the rule that matched, the action taken (allow, block, count, captcha), the source IP, and the request headers. The logs are the foundation for security analytics and rule tuning.

## Recommended method

[**S3 Log Forwarder**](./aws-client-s3) — configure logging on each web ACL with an S3 destination, then point the Bronto forwarder Lambda at the bucket.

## Alternatives

* [**Kinesis Firehose**](./aws-firehose) — for very high request volumes. WAF delivers logs directly to Firehose as native JSON, so Bronto flattens them into searchable fields automatically (`action`, `httpRequest.clientIp`, `terminatingRuleId`, …) — no parser needed.

  <Note>
    AWS requires the Firehose delivery stream name to start with `aws-waf-logs-` before WAF will allow it as a logging destination.
  </Note>
* [**CloudWatch Log Forwarder**](./aws-client-cloudwatch) — when logs are routed to a CloudWatch Log Group instead.

See [Ingesting AWS Data into Bronto](./aws-overview) for the full service-to-method mapping.

## References

* [AWS WAF — logging](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html)