---
title: "Discussion on \"Deploying a Custom WAF v2 Rule with the AWS CDK\" | Hashnode"
description: "Discussion on \"Deploying a Custom WAF v2 Rule with the AWS CDK\". I'm working with a client to migrate their infrastructure to AWS and apply some modest modernizations during phase 1 of the project. During the migration process, we need to keep their new public endpoints in AWS private during the testing phase. We ..."
url: "https://hashnode.com/posts/deploying-a-custom-waf-v2-rule-with-the-aws-cdk/63cf634c70d77aaa09d76efc"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Deploying a Custom WAF v2 Rule with the AWS CDK](https://benellis.cloud/deploying-a-custom-waf-v2-rule-with-the-aws-cdk?utm_source=hashnode&utm_medium=feed)

I'm working with a client to migrate their infrastructure to AWS and apply some modest modernizations during phase 1 of the project. During the migration process, we need to keep their new public endpoints in AWS private during the testing phase. We ...

Jan 24, 2023 · 3 min read · benellis.cloud  
Read the article

-   [#aws](https://hashnode.com/tag/aws)
-   [#aws-cdk](https://hashnode.com/tag/aws-cdk)
-   [#aws-cloudfront](https://hashnode.com/tag/aws-cloudfront)
-   [#aws-waf](https://hashnode.com/tag/aws-waf)

## Written by

[Ben Ellis](https://hashnode.com/@benb1n)

@benb1n · Springfield, MO

  
[View profile](https://hashnode.com/@benb1n)

Freelance Cloud Developer and Consultant, 5x AWS Certified, AWS Community Builder

I’m a software engineer turned cloud architect who is passionate about building right-sized, scalable solutions using the best of the cloud. I hold 5 AWS certs and counting, and I'm an AWS Community Builder for serverless.

## Responses 1

Markdown supported · ⌘↵ to post

[Edge Ops](https://hashnode.com/@edgecacheops)

[18h ago](https://hashnode.com/posts/deploying-a-custom-waf-v2-rule-with-the-aws-cdk/63cf634c70d77aaa09d76efc/comment/6af23bef0be8a10bf436adea)

A custom WAFv2 rule shipped through CDK is only as safe as the match and the action you pin in the stack. Prefer a narrow statement on the login or write path, key rate or label logic on the client address the edge restores, keep managed rule groups in count before block on a new WebACL, and treat CAPTCHA or challenge as a separate action so a bad match cannot lock out health checks.

Ops prove-out after the stack deploy: replay a clean canary Host under the allow path and a synthetic burst that should trip the custom rule, then confirm only the burst path returns the challenge or block while health probes still pass. Watch allowed and blocked counts by rule name for one deploy window — a spike on a previously quiet URI usually means the CDK statement drifted onto a shared prefix. Roll under peak and compare origin request rate; if origin climbs while the rule still reports allow, you are still in count mode where you think you are blocking.