Question

A financial services company runs a public web application behind an Application Load Balancer protected by AWS WAF. Compliance requires that all WAF request evaluations be retained for auditing, but the security team must ensure that sensitive HTTP header values (such as the Authorization header) are never stored in the logs. What is the MOST appropriate way to meet both requirements?

Accepted Answer

Enable AWS WAF logging to an Amazon Kinesis Data Firehose delivery stream and configure field redaction on the specified headers in the web ACL logging configuration.

Answer

Enable VPC Flow Logs on the ALB subnets and use a Lambda function to strip sensitive headers before writing to S3.

Answer

Enable AWS WAF logging directly to CloudWatch Logs and apply a metric filter to exclude any log lines containing the Authorization header.

Answer

Disable logging for rules that inspect sensitive headers and rely on ALB access logs for the audit trail.