Export AWS WAF Logs

This guide explains how to configure AWS WAF to deliver web ACL traffic logs to an AWS S3 bucket.

AWS WAF logging records requests inspected by a web ACL. Logging is configured for each web ACL, and the destination must be prepared before enabling logging. This guide uses the AWS WAF console and an S3 bucket destination.

Contents

Step 1 – Prepare an S3 bucket

  1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.
  2. Select the Region in which the AWS WAF web ACL is configured.
  3. Create a bucket, or select an existing bucket in the same account and Region. Make sure its name starts with aws-waf-logs- (for example, aws-waf-logs-production).
  4. Keep Block all public access enabled. Do not grant public access to the bucket.
  5. Choose the bucket’s encryption and lifecycle settings according to your organization’s security and retention requirements.

AWS WAF needs permission to deliver log objects to the bucket. When configuring logging, allow the AWS WAF console to add the required bucket policy permissions if prompted. If your organization manages bucket policies centrally, have an administrator apply the permissions required by the AWS WAF logging documentation before continuing.

Step 2 – Configure AWS WAF logging

  1. Open the AWS WAF console at https://console.aws.amazon.com/wafv2/.
  2. Select the Region that contains the web ACL.
  3. In the navigation pane, choose Web ACLs, then select the web ACL.
  4. Open the Logging and metrics tab and choose Enable logging.
  5. Select the Amazon S3 bucket destination. Choose the bucket created or selected in Step 1.
  6. Review the logging configuration. Optionally add filters to control which requests are logged and redact fields that should not be stored in logs.
  7. Choose Enable logging or Save to apply the configuration.

If AWS WAF reports that it cannot deliver logs, check the bucket name, account, Region, and bucket policy. Also confirm that your identity has permission to update the web ACL logging configuration and the bucket policy. Refer here for more details about the permissions required to publish AWS WAF logs to AWS S3.