JA EN
shiichan

AWS WAF Adds Salt Security's Managed Rules for API and MCP Threat Detection!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hey there, it's me, Shiichan! Today I found news about a new shield for APIs and AI agents. Security news like this always gets me a little excited.

AWS What's New aws.amazon.com

What was announced?

From AWS's What's New: AWS WAF now supports a Salt Security managed rule group. By subscribing to "Salt Managed Rules for AWS WAF - AI Agent & API Security" through AWS Marketplace, you get detection and mitigation for API-focused attacks and for traffic from AI agents and Model Context Protocol (MCP) endpoints, without writing or maintaining custom rules.

The story so far

Until now, watching for API-specific attacks or newer traffic types like MCP on AWS WAF meant writing and maintaining your own rules. Covering patterns like credential brute force, excessive GraphQL queries, or SSRF one by one took real effort.

What changes

You can now subscribe to the Salt Security rule group from the AWS WAF console and add it to a web ACL, with no additional configuration needed. That frees your team from maintaining custom rules so you can focus on the work that actually matters.

Dive Deep

Here's what the rule group detects:

  • Credential brute force attacks
  • Excessive GraphQL queries
  • Server-side request forgery (SSRF)
  • Prototype pollution
  • JSON Web Token (JWT) anomalies

For MCP endpoints, it identifies and labels the traffic, blocks unauthenticated MCP access, and adds observability into MCP interactions inside AWS WAF. It also applies rate limiting to sensitive request parameters like user identifiers and email addresses, helping mitigate enumeration and abuse. For downstream analysis, it labels request attributes such as authorization headers, user identifiers, and GraphQL queries.

The rule group supports versioning, and pricing is set by Salt Security through AWS Marketplace. You can get started from the AWS WAF console or by finding the rule group in AWS Marketplace.

Wrap-up

  • AWS WAF now supports Salt Security's managed rule group, detecting API attacks and MCP traffic without custom rules
  • It catches brute force, excessive GraphQL queries, SSRF, prototype pollution, and JWT anomalies
  • MCP endpoints get identification, unauthenticated access blocking, and observability
  • Rate limiting on sensitive parameters helps curb impersonation and enumeration attacks
  • A great option for security teams exposing AI agents or MCP over public APIs

Related posts