How can we use different WAF rule over ALB target group?

Question

I use one ALB, and there are two target groups. I change the traffic by the host name.

• stg.example.com goes to stg target group.
• example.com goes to prd target group.

I'm thinking to use aws WAF to ALB. I saw path matching condition, but it seems to be for URL resources such as /users, /admin What I want to do is changing the WAF rule for stg and prd. How can I do this? Can we specify the target group or host name match?

Answer 1

You could create a rule based on Referer header. The use of Referer is not a bulletproof solution as Referer can be spoofed, but it could suit your needs nevertheless. Similarly you could look at a rule based on All query parameters.