Search code examples
amazon-web-servicesamazon-cloudwatchamazon-waf

AWS Web Application Firewall Metrics: Rules & Rule Groups

I am trying to put alarms in place to monitor blocked requests. I'm making use of several AWS Managed Rule Groups as part of my rules.

After looking at the AWS documentation for WAF metrics, I'm uncertain whether my alarm dimensions should be based on a rule, or a rule group.

The confusion stems from the rules themselves containing the managed rule groups. Should I provide the managed rule group or simply my rule which contains the managed rule group as the dimension for my cloudwatch metric alarms?

Solution

  • When specifying a rule, you have the option to create a CloudWatch metric for it. That metric name is then used, along with dimensions, to build out the alarms for BlockedRequests, AllowedRequests, etc.

    This allows you to create general monitoring for the entire rule group.