AWS WAF is a web application firewall that protects applications and APIs from common exploits such as SQL injection and cross-site scripting. It filters traffic using customizable rules and AWS Managed Rules, and can guard resources fronted by CloudFront, API Gateway, or Application Load Balancer. Rate-based rules and bot control help defend against volumetric and automated attacks at the application layer.