+91 80401 38000[email protected]24/7 Expert Support
[email protected]Client Portal →
ServerGurus
← All posts
CloudSecurityAWSDDoSWAF

AWS WAF Anti-DDoS Rule Group: How to Migrate Before the January 2027 Deadline

By ServerGurus Team28 July 20266 min read
AWS WAF Anti-DDoS Rule Group: How to Migrate Before the January 2027 Deadline

What Is Happening

On January 1, 2027, AWS will shut down Shield Advanced's application-layer (L7) automatic mitigation. Any web ACL that has not migrated to the new Anti-DDoS managed rule group will lose automated L7 DDoS protection. This affects every Shield Advanced subscriber running web applications behind AWS WAF.

The replacement - the Anti-DDoS managed rule group - is already rolling out. Between July 27 and August 7, 2026, AWS is adding it in Count mode to all eligible Shield Advanced web ACLs. You have until October to evaluate it before AWS flips it to Block mode automatically.

What Changes

Feature Old (Shield Advanced L7) New (Anti-DDoS Rule Group)
Activation Automatic, opaque Managed rule group, configurable
Action types Block Block, Challenge, Count
Sensitivity Single setting Independent Block and Challenge sensitivity
WCU cost 150 WCUs 50 WCUs
Dashboard None DDoS events + traffic insights
Request labels No Every request labeled for custom rules
Cost during attack Charged Blocked DDoS requests excluded from charges
Path exemptions Manual URI exemptions supported

The Challenge action is the headline feature. It performs silent browser verification - no CAPTCHA, no user friction - using AWS's AMR (Automated Mitigation Response) labels. Legitimate traffic passes through invisibly. Bot traffic gets challenged. Attack traffic gets blocked.

The Five-Phase Migration Timeline

Phase 1: July 27 - August 7, 2026

AWS adds the Anti-DDoS rule group to eligible web ACLs in Count mode. No traffic is blocked. You get visibility into what would have been detected and blocked.

Phase 2: August - September 2026

Your evaluation window. Review the Anti-DDoS dashboard in the AWS WAF console. Compare DDoSDetected and DDoSAttackRequests metrics against your existing Shield Advanced data. Use AWS WAF labels to analyze suspicious requests without impacting production traffic.

Phase 3: October 2026

AWS automatically upgrades the rule group from Count to Block mode. If you have not configured your own Block action by this point, AWS applies a default Low-sensitivity Block.

Phase 4: October - December 2026

Both the old Shield Advanced L7 mitigation and the new rule group run in parallel. This is your safety net - you can still fall back to the old system if something breaks.

Phase 5: January 1, 2027

Shield Advanced L7 automatic mitigation is discontinued. Only the Anti-DDoS managed rule group provides automated L7 DDoS protection.

How to Migrate: Step by Step

Step 1: Locate the Rule Group

Starting July 27, check your web ACLs:

aws wafv2 list-rule-groups --scope REGIONAL

Look for AWSManagedRulesAntiDDoSRuleSet in the managed rule groups. If it is not yet added, you can add it manually.

Step 2: Monitor in Count Mode

Before blocking anything, understand what the rule group would block:

{
  "Name": "AWS-AntiDDoS-RuleGroup",
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AntiDDoSRuleSet"
    }
  },
  "OverrideAction": {
    "Count": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AntiDDoSRuleGroup-Count"
  }
}

This sets the rule group to Count mode - it inspects all traffic and logs what it would have blocked, but does not actually block anything.

Step 3: Use the New Dashboard

Navigate to AWS WAF Console → Anti-DDoS Dashboard. You will see:

  • DDoSDetected: Total requests identified as L7 DDoS
  • DDoSAttackRequests: Requests blocked or challenged by the rule group
  • Request labels: Every inspected request tagged with a reason label
  • Traffic insights: Baseline vs attack traffic patterns

Compare these against what Shield Advanced previously reported. If the rule group flags legitimate traffic, adjust sensitivity down. If it misses attacks that Shield Advanced caught, adjust sensitivity up.

Step 4: Configure Block Sensitivity

Start with Low sensitivity and work upward:

{
  "ManagedRuleGroupConfig": {
    "AWSManagedRulesAntiDDoSRuleGroupConfig": {
      "BlockSensitivity": "LOW",
      "ChallengeSensitivity": "MEDIUM"
    }
  }
}

Sensitivity levels:

  • Low: Blocks only unambiguous attack patterns. Fewest false positives.
  • Medium: Blocks more aggressively. Good for most production workloads.
  • High: Maximum protection. Use for applications under active attack.

Challenge and Block can be set independently. For example: Challenge at Medium (silent browser check for suspicious traffic), Block at Low (only block confirmed attacks).

Step 5: Configure URI Exemptions

Some paths should never be blocked by a DDoS rule - health checks, OAuth callbacks, webhook receivers:

{
  "ManagedRuleGroupConfig": {
    "AWSManagedRulesAntiDDoSRuleGroupConfig": {
      "UriExemptions": [
        "/health",
        "/api/webhooks/stripe",
        "/oauth/callback"
      ]
    }
  }

Traffic to exempted paths still goes through the rule group for inspection but is never blocked or challenged. It still gets labeled, so you can build custom rules downstream.

Step 6: Build Custom Rules on Labels

Every request inspected by the Anti-DDoS rule group receives a label. Use these in your own WAF rules:

awswaf:managed:aws:anti-ddos:DDoSAttackRequest
awswaf:managed:aws:anti-ddos:HighRateRequest
awswaf:managed:aws:anti-ddos:SuspiciousHeaderPattern

Example: forward high-rate requests to a dedicated rate-limit queue instead of blocking them outright:

{
  "Name": "RateLimitHighDDoS",
  "Statement": {
    "LabelMatchStatement": {
      "Scope": "LABEL",
      "Key": "awswaf:managed:aws:anti-ddos:HighRateRequest"
    }
  },
  "Action": {
    "Block": {}
  }
}

Step 7: Update IaC Templates

If you manage WAF through Terraform, CloudFormation, or CDK:

Terraform:

resource "aws_wafv2_web_acl" "main" {
  rule {
    name     = "AntiDDoS"
    priority = 1
    override_action {
      count {}
    }
    statement {
      managed_rule_group_statement {
        name        = "AntiDDoSRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AntiDDoSRuleGroup"
      sampled_requests_enabled   = true
    }
  }
}

CloudFormation:

Rules:
  AntiDDoSRule:
    Name: AntiDDoSRuleGroup
    Priority: 1
    OverrideAction:
      Count: {}
    Statement:
      ManagedRuleGroupStatement:
        VendorName: AWS
        Name: AntiDDoSRuleSet
    VisibilityConfig:
      SampledRequestsEnabled: true
      CloudWatchMetricsEnabled: true
      MetricName: AntiDDoSRuleGroup

Step 8: Verify Before October

Before the October automatic upgrade:

# Check the rule group is present
aws wafv2 get-web-acl --name YourWebACL --scope REGIONAL | grep AntiDDoS

# Check CloudWatch metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/WAFV2 \
  --metric-name DDoSAttackRequests \
  --start-time 2026-09-01T00:00:00Z \
  --end-time 2026-09-07T00:00:00Z \
  --period 3600 \
  --statistics Sum

# Verify labels are being applied
aws wafv2 get-sampled-requests \
  --web-acl-arn arn:aws:wafv2:region:account:regional/webacl/name \
  --rule-metric-name AntiDDoSRuleGroup \
  --scope REGIONAL \
  --max-items 5

What to Do If You Are Not Using Shield Advanced

The Anti-DDoS rule group is available to all AWS WAF customers - not just Shield Advanced subscribers. If you use AWS WAF without Shield Advanced, you can enable the rule group now for 50 WCUs. Shield Advanced subscribers get it at no additional cost with existing WAF associations.

How ServerGurus Helps

If you host behind AWS WAF through our managed infrastructure or CloudFront distributions, we are handling the migration as part of your managed service. All ServerGurus-managed WAF configurations are being updated with the Anti-DDoS rule group in Count mode during the July 27 - August 7 window. No action is needed on your side - we will notify you when the evaluation report is ready.

For customers running their own AWS accounts, we offer a one-time WAF migration review: we audit your web ACLs, add the rule group, configure sensitivity based on your traffic patterns, and validate against your existing Shield Advanced data. Contact our team for availability.

Quick Checklist

  • Verify the Anti-DDoS rule group is in your web ACL (Count mode)
  • Review the Anti-DDoS dashboard in WAF console
  • Compare DDoSDetected vs DDoSAttackRequests metrics
  • Configure Block sensitivity starting from Low
  • Add URI exemptions for health checks and webhooks
  • Update Terraform/CloudFormation IaC templates
  • Set CloudWatch alarms on DDoS metric thresholds
  • Schedule cutover from Count to Block before October

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales