MCP Server WAF — AWS WAF v2 rate limiting, managed rules, bot control, IP blocking

WebACL setup and scope

A WebACL is the top-level WAF resource. Scope determines which AWS resource type it can protect: REGIONAL for ALB, API Gateway, AppSync, and Cognito User Pools; CLOUDFRONT for CloudFront distributions (must be created in us-east-1 even if your distribution serves content globally).

// CDK: WAF WebACL for ALB (REGIONAL scope, any region)
import * as wafv2 from "aws-cdk-lib/aws-wafv2";

const webAcl = new wafv2.CfnWebACL(this, "McpWebAcl", {
  scope: "REGIONAL",    // for ALB; use "CLOUDFRONT" in us-east-1 for CloudFront
  defaultAction: { allow: {} },
  visibilityConfig: {
    cloudWatchMetricsEnabled: true,
    metricName: "McpWafMetrics",
    sampledRequestsEnabled: true,
  },
  rules: [
    // 1. Rate-based rule: block IPs exceeding 1000 requests per 5 minutes
    {
      name: "RateLimitMcpApi",
      priority: 1,
      action: { block: {} },
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: "McpRateLimit",
        sampledRequestsEnabled: true,
      },
      statement: {
        rateBasedStatement: {
          limit: 1000,                        // requests per 5-minute window per IP
          aggregateKeyType: "IP",
          scopeDownStatement: {
            orStatement: {
              statements: [
                { byteMatchStatement: { fieldToMatch: { uriPath: {} }, searchString: "/mcp", positionalConstraint: "STARTS_WITH", textTransformations: [{ priority: 0, type: "NONE" }] } },
                { byteMatchStatement: { fieldToMatch: { uriPath: {} }, searchString: "/api/", positionalConstraint: "STARTS_WITH", textTransformations: [{ priority: 0, type: "NONE" }] } },
              ],
            },
          },
        },
      },
    },
    // 2. AWS Common Rule Set (managed, free)
    {
      name: "AWSCommonRules",
      priority: 2,
      overrideAction: { none: {} },
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: "AWSCommonRules",
        sampledRequestsEnabled: true,
      },
      statement: {
        managedRuleGroupStatement: {
          vendorName: "AWS",
          name: "AWSManagedRulesCommonRuleSet",
          excludedRules: [
            { name: "SizeRestrictions_BODY" },        // MCP tool calls may have large context payloads
            { name: "CrossSiteScripting_BODY" },      // JSON tool args may contain HTML fragments
            { name: "GenericRFI_BODY" },              // false positives on URL tool arguments
          ],
        },
      },
    },
    // 3. Known Bad Inputs Rule Set (managed, free)
    {
      name: "KnownBadInputs",
      priority: 3,
      overrideAction: { none: {} },
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: "KnownBadInputs",
        sampledRequestsEnabled: true,
      },
      statement: {
        managedRuleGroupStatement: {
          vendorName: "AWS",
          name: "AWSManagedRulesKnownBadInputsRuleSet",
        },
      },
    },
  ],
});

// Associate WebACL with ALB
new wafv2.CfnWebACLAssociation(this, "McpWafAssociation", {
  resourceArn: alb.loadBalancerArn,
  webAclArn: webAcl.attrArn,
});

IP set blocklist and bot control

IP sets allow you to maintain a manually-managed blocklist of known bad IPs or CIDRs. Bot Control adds automated bot detection and CAPTCHA challenges for suspected bot traffic, at additional cost ($10/month + $1/million requests inspected).

// CDK: IP set blocklist
const blocklist = new wafv2.CfnIPSet(this, "McpBlocklist", {
  scope: "REGIONAL",
  ipAddressVersion: "IPV4",
  addresses: [
    "198.51.100.0/24",   // example bad-actor CIDR
    "203.0.113.42/32",   // specific IP
  ],
});

// Rule to block the IP set (add to rules array at priority 0 — highest priority)
{
  name: "BlocklistedIPs",
  priority: 0,    // evaluated before rate limits and managed rules
  action: { block: {} },
  visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "BlocklistedIPs", sampledRequestsEnabled: true },
  statement: {
    ipSetReferenceStatement: {
      arn: blocklist.attrArn,
    },
  },
}

// Update IP set via CLI (no CDK redeploy needed)
// aws wafv2 update-ip-set --scope REGIONAL --id IPSET_ID --name McpBlocklist \
//   --lock-token $(aws wafv2 get-ip-set --scope REGIONAL --id IPSET_ID --name McpBlocklist --query LockToken --output text) \
//   --addresses '["198.51.100.0/24","203.0.113.42/32","192.0.2.100/32"]'

WAF logging and rule tuning

WAF logging records every request that matches a rule (or all requests, at higher cost). Log to S3 for long-term audit trail or to CloudWatch Logs for real-time querying. Always run new managed rule groups in Count mode (override action count) before switching to Block — this reveals false positives without impacting traffic.

// CDK: WAF logging to S3
import * as s3 from "aws-cdk-lib/aws-s3";

const wafLogsBucket = new s3.Bucket(this, "WafLogs", {
  bucketName: `aws-waf-logs-mcp-${this.account}`,   // bucket name must start with "aws-waf-logs-"
  lifecycleRules: [{ expiration: Duration.days(90) }],
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
  removalPolicy: RemovalPolicy.RETAIN,
});

new wafv2.CfnLoggingConfiguration(this, "WafLogging", {
  resourceArn: webAcl.attrArn,
  logDestinationConfigs: [wafLogsBucket.bucketArn],
  // Redact sensitive headers from logs
  redactedFields: [
    { singleHeader: { name: "authorization" } },
    { singleHeader: { name: "cookie" } },
  ],
});

// Athena query to find blocked requests in WAF logs:
// SELECT timestamp, httprequest.clientip, httprequest.uri, terminatingruleid
// FROM waf_logs
// WHERE action = 'BLOCK'
//   AND timestamp > to_unixtime(current_timestamp - interval '1' hour) * 1000
// ORDER BY timestamp DESC
// LIMIT 100;

Rule tuning workflow: deploy managed rules with overrideAction: { count: {} } for one week. Query WAF logs for COUNTED requests on your MCP API paths. If SizeRestrictions_BODY counts many legitimate large tool calls, keep it excluded. If CrossSiteScripting_BODY shows zero counts on your API paths, you can safely enable it as Block. Switch to overrideAction: { none: {} } (defers to each rule's individual action) once you're confident in the false-positive rate.

Common failure modes