1 of 7

AWS WAF at Emory

Beth Crompton

EULM Technology and Digital Strategies

Senior System Administrator

2 of 7

Agenda

  • Architecture
  • Cost
  • Configuration
  • Efficacy

​

​

​

3 of 7

Architecture

​

​

​

4 of 7

Cost

6 months, 3 applications

​

​

5 of 7

Configuration- Most Used Rules

​

  • Captcha excessive
    • 300 requests in 2 minutes
  • IP block list
    • Not the correct approach
  • AWS Managed Ruleset
    • Purchased ruleset, $10/month

​

​

6 of 7

Efficacy

​

  • Implemented Dec 2023
  • Configuration has been a process
  • Last bot related outage May 2025

​

​

​

7 of 7

Questions?

​

  • Beth.Crompton@emory.edu

​

​

​