AWS WAF Classic

Name: AWS WAF Classic API
Brand: AWS WAF Classic
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey77 EndpointsREST

Install Jentic One Beta

Connect the AWS WAF Classic to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS WAF Classic, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS WAF Classic API.

Build IP, geo, byte, regex, size, SQL injection, and XSS match conditions

Compose match conditions into rules and rate-based rules

Group rules into reusable rule groups

Assemble Web ACLs and order rules with explicit priority

GET STARTED

Start building with AWS WAF Classic API

Explore with Jentic

View OpenAPI Document

For Agents

Manage AWS WAF Classic Web ACLs, rules, and match conditions so an agent can block bad IPs, geo-restrict traffic, and add SQLi/XSS protection to CloudFront and ALB.

Use for: Block traffic from a list of malicious IP addresses, Create a geo-match rule that blocks requests from specific countries, Add a SQL injection match condition to my Web ACL, Set up a rate-based rule to throttle abusive clients

Not supported: Does not handle DDoS mitigation, network-layer firewall rules, or modern WAFv2 rule groups - use for managing AWS WAF Classic match conditions, rules, and Web ACLs only.

Use Cases

Patterns agents use AWS WAF Classic API for, with concrete tasks.

★ IP Blocklist Automation

Automate response to abuse by syncing a threat-intel IP feed into an AWS WAF Classic IPSet. UpdateIPSet (with a change token from GetChangeToken) adds and removes /32 or /24 entries without recreating the set, and the IPSet is referenced by a rule in a Web ACL attached to CloudFront or an ALB. End-to-end, an agent can react to abuse signals in seconds without touching the underlying L7 protection layer.

Call GetChangeToken, then UpdateIPSet with IPSetId, ChangeToken, and Updates listing IPSetDescriptors with Action INSERT for each malicious /32 IP.

Rate-Based Throttling for Login Abuse

Create a RateBasedRule that triggers when a single IP exceeds a threshold (e.g. 2000 requests in 5 minutes) and pair it with byte-match conditions on /login. CreateRateBasedRule sets the RateLimit and RateKey; UpdateWebACL inserts the rule with a BLOCK action above other rules. This is the standard AWS WAF Classic pattern for stopping credential-stuffing without rolling your own rate limiter.

Call CreateRateBasedRule with Name 'login-rate-limit', MetricName 'loginRateLimit', RateKey 'IP', RateLimit 2000, then UpdateWebACL to add the new rule with Action BLOCK at Priority 1.

Migrating to WAFv2

AWS recommends migrating from WAF Classic to WAFv2 for richer rule constructs, managed rule groups, and JSON-based configuration. CreateWebACLMigrationStack generates a CloudFormation template that recreates an existing Classic Web ACL as a v2 ACL in a target S3 bucket; deploying that stack gives you a WAFv2 equivalent you can iterate on. List operations on Classic resources help inventory what still needs migrating.

Call CreateWebACLMigrationStack with WebACLId of the Classic ACL, S3BucketName for the generated CloudFormation, and IgnoreUnsupportedType=false.

Agent-Driven Web ACL Updates via Jentic

A security agent ingesting threat-intel events can update WAF Classic IP sets and rules through Jentic without ever holding AWS keys. The agent submits an intent like 'block these ten IPs in production WAF'; Jentic loads GetChangeToken, then UpdateIPSet, executes them in sequence, and returns the new ChangeToken status. All keys stay vaulted and the agent's context never sees a SecretAccessKey.

Through Jentic, search for 'add ips to an aws waf classic ip set', load GetChangeToken and UpdateIPSet, and execute the pair to insert a list of IPs.

Key Endpoints

77 endpoints — jentic publishes the only available openapi specification for aws waf classic, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/#X-Amz-Target=AWSWAF_20150824.CreateIPSet

Create an IP set used by a rule

POST

/#X-Amz-Target=AWSWAF_20150824.CreateRateBasedRule

Create a rate-based rule

POST

/#X-Amz-Target=AWSWAF_20150824.CreateWebACL

Create a Web ACL

POST

/#X-Amz-Target=AWSWAF_20150824.GetChangeToken

Fetch a change token before mutating resources

POST

/#X-Amz-Target=AWSWAF_20150824.CreateWebACLMigrationStack

Generate a CloudFormation stack to migrate to WAFv2

POST

/#X-Amz-Target=AWSWAF_20150824.CreateIPSet

Create an IP set used by a rule

POST

/#X-Amz-Target=AWSWAF_20150824.CreateRateBasedRule

Create a rate-based rule

POST

/#X-Amz-Target=AWSWAF_20150824.CreateWebACL

Create a Web ACL

POST

/#X-Amz-Target=AWSWAF_20150824.GetChangeToken

Fetch a change token before mutating resources

POST

/#X-Amz-Target=AWSWAF_20150824.CreateWebACLMigrationStack

Generate a CloudFormation stack to migrate to WAFv2

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to sign each WAF Classic request with SigV4 at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'add IPs to a WAF Classic IP set' or 'create a rate-based rule', and Jentic returns the matching WAF Classic operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using AWS WAF Classic API through Jentic.

Why is there no official OpenAPI spec for AWS WAF Classic?

AWS does not publish an OpenAPI specification for AWS WAF Classic; it ships Smithy models and language-specific SDKs instead. Jentic generates and maintains this OpenAPI spec so that AI agents and developers can call AWS WAF Classic via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does AWS WAF Classic use?

AWS WAF Classic uses AWS SigV4 with X-Amz-Target identifying the action (e.g. AWSWAF_20150824.UpdateIPSet). It also requires the change-token workflow: every mutating call must include a fresh ChangeToken obtained from GetChangeToken. Through Jentic, your AWS keys remain in the vault and Jentic signs each request.

Can I block traffic by country with AWS WAF Classic?

Yes. Create a GeoMatchSet with GeoMatchConstraints listing ISO country codes, attach it to a rule via UpdateRule, and add the rule to a Web ACL with a BLOCK action. Combine with byte-match conditions to scope the block to specific paths or hosts.

What are the rate limits for AWS WAF Classic?

Management API throughput is modest - a few transactions per second per account - because most calls require a fresh change token. The data-plane (request inspection) is independent and scales with the protected service. Most quotas (rules per Web ACL, IP entries per set) are increasable via AWS Support.

How do I add IPs to a WAF IP set through Jentic?

Search Jentic with 'add ips to an aws waf classic ip set', load GetChangeToken, then UpdateIPSet, and execute the pair: GetChangeToken returns a ChangeToken, then UpdateIPSet uses it together with IPSetId and Updates listing IPSetDescriptors to insert.

Should I use WAF Classic or WAFv2 for new deployments?

AWS recommends WAFv2 for new work; it offers managed rule groups, JSON-style rule statements, and CloudFront and Regional integrations under one API. Use this Classic API when working with existing Classic Web ACLs or running CreateWebACLMigrationStack to upgrade them.

Can I attach a WAF Classic Web ACL to an Application Load Balancer?

Yes. Create the Web ACL with this API, then call AssociateWebACL to attach it to the ALB or CloudFront distribution. The Web ACL evaluates inbound requests in priority order and applies the matched rule's action (ALLOW, BLOCK, or COUNT).

Can I limit what my agent is allowed to do with the AWS WAF Classic API?

Yes. Because you run Jentic One yourself, your own rules decide which AWS WAF Classic operations and credentials the agent may use. AWS WAF Classic routes every action through a single endpoint by X-Amz-Target rather than by resource ids in the path, so you scope the agent to just the operations it needs, such as GetChangeToken and CreateIPSet. You choose the operations it may call, so a Web ACL delete is not available to the agent unless you explicitly add it.

AWS WAF Classic

Connect the AWS WAF Classic to your agent

Capabilities

Start building with AWS WAF Classic API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs