In general, I'm not a huge fan of using WAFs to protect web applications -- I've spent too much of my career bypassing WAFs to have a lot of confidence in them. That said, using a WAF can hugely improve application security visibility, if not increase actual resilience.
The AWS WAF is, presumably, going to give application developers and owners significantly more insight into whether their apps are getting attacked. Congratulations to the Amazon team for shipping something that has the potential to make a really big difference.
At this point, my only question is why Amazon didn't give it a strange name (like most of the other AWS products)!
From the defensive side, WAFs can be quite helpful for alerting. It's detection, typically not prevention (against a dedicated attacker at least), but it helps.
I've seen attack traffic on machines within 30 minutes of adding an IP address to a domains DNS records. Before the web server was even up to record the we attempts, it was being hit with ssh brute force attempts.
The AWS WAF is, presumably, going to give application developers and owners significantly more insight into whether their apps are getting attacked. Congratulations to the Amazon team for shipping something that has the potential to make a really big difference.
At this point, my only question is why Amazon didn't give it a strange name (like most of the other AWS products)!