We have a server that is set up with an ALB and a WAF.
As requests for your websites come into the underlying service, it transmits them to AWS WAF for review in accordance with your rules. AWS WAF informs the underlying service to either block or accept the request based on the action you describe after a request meets a condition specified in your rules.
According to what is stated above in the AWS FAQ, requests first go to the ALB before being forwarded to the WAF.
My surroundings raise questions for me. On ALB, I saw some bad queries that return a 400 code. Since they are not included in WAF, does this imply that ALB processes bad requests? incorrect requests are not