AWS WAF Rate Limiting Based on Origin Response

The article presents a hybrid approach combining AWS WAF rate limiting with Lambda@Edge to protect CloudFront-served S3 static files from automated crawling without blocking legitimate users. A soft WAF threshold uses Count action with a custom header flag, a hard threshold blocks heavy attacks outright, and a Lambda@Edge origin-response trigger checks both the flag and the HTTP status to selectively return 429 responses only for rate-exceeded requests that hit non-existent URLs.