AWSAWS Certified Generative AI Developer - Professional2026-103.1 Implement input and output safety controls

Bound hostile traffic before inference begins

Completed by the knowledge check

Learning objective

Protect public GenAI HTTP endpoints from malicious inbound requests using AWS WAF web ACL rules.

Core idea

AWS WAF protects the HTTP request boundary before the application performs retrieval, model inference, or tool execution. Use it to reject known web attack patterns, unsuitable request shapes, and abusive traffic rates. Keep semantic model safety and caller authorization in their own gates: an allowed HTTP request can still contain a prompt attack or request unauthorized data.

AWS documentation calls the configuration a protection pack (web ACL). This is the resource described by the objective’s web ACL wording. The important architectural decision is which supported front door receives the association and which requests its rules actually inspect. A policy defined without the right resource association does not protect your endpoint.

How it works

Associate protection with a supported front door

AWS documents CloudFront distributions and regional resources such as Application Load Balancers and API Gateway REST APIs as supported association targets. For API Gateway, do not generalize REST API support to every API Gateway API type. An HTTP API is not the documented regional REST API target. Verify the serving topology before choosing an association.

Regional web ACLs and their dependent AWS WAF resources belong in the same Region as the protected regional resource. For CloudFront, create the web ACL and its dependent WAF resources in US East (N. Virginia), us-east-1. A web ACL associated with CloudFront cannot also be associated with another resource type, and each protected resource can have only one web ACL.

Protect the route that callers can actually reach. If CloudFront is your public front door, verify whether callers can also reach an unprotected origin. An edge-only rule cannot evaluate a request that bypasses that edge. This is a deployment acceptance test, not a claim that WAF automatically removes alternative routes.

Compose web attack and endpoint-specific rules

A web ACL can match IP origin, geography, strings or regular expressions, request-component sizes, and malicious SQL or scripting. Apply those criteria to the parts of the request that your API uses. A query-string-only check does not establish that a JSON prompt body passed inspection.

The AWS managed core rule set uses VendorName: AWS and Name: AWSManagedRulesCommonRuleSet. It covers common web application vulnerabilities. Its individual rules matter: SizeRestrictions_BODY blocks bodies over 8 KB (8,192 bytes). That rule threshold is separate from the amount of body data the resource can forward for WAF inspection.

A GenAI API that legitimately accepts more than 8 KB can therefore fail this managed rule even when its configured inspection limit is larger. Review and test the specific matching rule before changing the policy. Keep any exception narrowly tied to a documented application requirement and preserve the other protections. Increasing the inspection limit alone does not change the managed rule’s size threshold.

Managed web rules do not establish semantic prompt safety. A SQL injection signature in an HTTP request and model-generated SQL awaiting execution are different boundaries. The former belongs to inbound web protection; the latter requires the validation and authorization checks in 3.1.5. Direct and indirect prompt attacks need the controls in 3.1.8.

Make body inspection limits explicit

For Application Load Balancer, the body inspection limit is fixed at 8 KB (8,192 bytes). For CloudFront and API Gateway, the default is 16 KB (16,384 bytes), configurable in increments of 16 KB up to 64 KB. AWS WAF’s web ACL AssociationConfig controls the configurable limit. Above the limit, the host service forwards only the inspectable portion to WAF.

Treat inspection size and accepted application payload size as separate settings. Your application might accept a large prompt, but WAF cannot inspect bytes that the front door does not forward. Placing malicious text after a benign inspected prefix is therefore an important boundary test. Raising the limit costs additional inspection fees for requests larger than the default 16 KB; choose it from workload requirements, not as an unlimited-coverage assumption.

For a rule inspecting the body, OversizeHandling selects CONTINUE, MATCH, or NO_MATCH. CONTINUE evaluates only the inspectable content. MATCH treats an oversized request as matching the statement; paired with a Block action, it rejects the request. NO_MATCH treats it as not matching that statement and leaves other rules and the default policy to determine the outcome.

AWS recommends placing a dedicated oversize-blocking rule before the body-inspection rules it protects. Lower numeric rule priority evaluates first. This prevents later rules from relying on an incomplete body without an explicit exception policy. An oversized body is not automatically blocked merely because WAF cannot inspect all of it.

Limit expensive request paths by observed rate

A RateBasedStatement aggregates requests according to AggregateKeyType, counts them over EvaluationWindowSec, and applies its configured action when Limit is exceeded. Aggregation options include IP, FORWARDED_IP, CUSTOM_KEYS, and CONSTANT. A ScopeDownStatement restricts the counted traffic, for example to the generation route rather than health checks.

Valid evaluation windows are 60, 120, 300, and 600 seconds; the default is 300. The window determines how far back WAF counts, not the frequency of enforcement checks. AWS states that it checks the rate about every 10 seconds. A rate rule is therefore not a precise per-request inference budget or a hard account spending cap. See 2.4.6 for application-facing throttling controls.

Choose aggregation from the abuse pattern. An IP limit can affect many legitimate users behind shared network egress. A header-based key can be unsuitable when the caller controls the header. AWS also omits requests missing a configured aggregation component from rate-rule evaluation. Test missing-key cases instead of assuming every request contributes to the count.

Key distinctions and trade-offs

Separate three decisions: which HTTP request patterns match, how much of each component WAF can inspect, and what action matching rules take. Count mode supplies observation rather than the intended blocking protection. Test and tune in staging, then examine production traffic in count mode before enabling the enforcement change, as AWS recommends.

Large legitimate prompts increase the pressure to relax size rules. Do not turn that requirement into an unrestricted bypass. Define an accepted payload envelope, inspect as much as the supported resource permits, and enforce an explicit policy for the remainder. Backend validation and model safety checks remain necessary after WAF permits the request; see 3.1.9.

Architecture / decision scenario

A public support API uses an API Gateway REST API and accepts JSON prompts up to a documented application limit. The team associates a regional web ACL, enables the managed core rule set, adds a generation-route rate rule, and blocks oversize bodies before later body-inspection rules.

Staging tests include ordinary prompts, a legitimate prompt over 8 KB, attack signatures, a payload with malicious text beyond the inspection boundary, repeated requests, and missing rate-aggregation fields. The long benign prompt exposes the managed SizeRestrictions_BODY threshold. The team resolves that specific policy conflict and retests instead of assuming that a larger inspection setting fixes it.

Production count-mode evidence checks false positives before blocking begins. Accepted requests still pass backend authorization and semantic safety gates. The release verifies both the web ACL association and the absence of an unintended public bypass path.

Common exam traps

Assuming REST API association support covers API Gateway HTTP APIs.
Attaching a CloudFront web ACL in an arbitrary Region.
Confusing the 8 KB managed size rule with a 16–64 KB inspection limit.
Assuming oversize content is blocked under CONTINUE.
Treating Count mode as protection that rejects matches.
Treating a rate rule as an exact quota or WAF as prompt-injection detection.

What to remember

Associate the web ACL with a supported reachable resource. Tune concrete rules, accepted sizes, inspection limits, and oversize behavior together. Rate rules bound abusive traffic patterns without replacing exact application budgets. WAF protects the inbound HTTP boundary; authorization and model safety protect the behavior that follows.