AWS WAF
BetaThis source is currently in beta. It works end to end, but you may still hit rough edges. Let us know if you do.
Let AI connect your sources for you
Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.
Connect AWS WAF to PostHog to sync your data into the PostHog data warehouse for analysis and modeling.
Sync AWS WAF configurations into the PostHog Data warehouse.
Grant wafv2:ListWebACLs and wafv2:GetWebACL to sync web ACLs.
Grant wafv2:ListRuleGroups and wafv2:GetRuleGroup to sync rule groups.
Grant wafv2:ListIPSets and wafv2:GetIPSet to sync IP sets.
Grant wafv2:ListRegexPatternSets and wafv2:GetRegexPatternSet to sync regex pattern sets.
Grant wafv2:ListAvailableManagedRuleGroups and wafv2:DescribeManagedRuleGroup to sync managed rule groups.
Grant wafv2:ListWebACLs and wafv2:ListResourcesForWebACL, plus the read permissions for each protected resource type, to sync protected resources.
Grant wafv2:ListWebACLs, wafv2:GetWebACL, and wafv2:GetSampledRequests to sync sampled requests.
Grant cloudwatch:ListMetrics and cloudwatch:GetMetricData to sync request metrics.
Select a region for regional resources. CloudFront resources use us-east-1. Sampled requests cover at most the last 3 hours, so sync them at least every 3 hours to keep a continuous history. Protected resources are only listed for the regional scope.
Configuration
| Option | Description |
|---|---|
AWS access key IDType: text Required: True | |
AWS secret access keyType: password Required: True | |
AWS session tokenType: password Required: False | Temporary credentials expire. Scheduled syncs fail after the session token expires. |
AWS regionType: text Required: True | |
Resource scopeType: select Required: True | CloudFront resources always use us-east-1. |
Linking AWS WAF to PostHog
- Go to the Data pipeline page in PostHog
- Click New source and select AWS WAF
- Fill in the required configuration fields
- Click Next, select the tables you want to sync, and then press Import
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
web_acls | Web access control lists, with their rules, default actions, and visibility settings. | Full refresh | — | — |
rule_groups | Rule groups that you manage, with their rules and capacity settings. | Full refresh | — | — |
ip_sets | IP sets with their IP version and address ranges in CIDR notation. | Full refresh | — | — |
regex_pattern_sets | Sets of regular expressions that rules use to inspect web requests. | Full refresh | — | — |
managed_rule_groups | Managed rule groups available to the account, with their rules, labels, and capacity. | Full refresh | — | — |
protected_resources | Regional resources that each web ACL protects, such as load balancers and API stages. | Full refresh | — | — |
sampled_requests | Samples of recent web requests that matched web ACL rules, with the action AWS WAF took. | Incremental, Full refresh | timestamp | — |
request_metrics | Hourly CloudWatch request counts for web ACLs, rules, and labels, such as allowed and blocked requests. | Incremental, Full refresh | timestamp | — |