https://aws.amazon.com/waf/ WAF Classic: https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html WAF Standard: https://docs.aws.amazon.com/waf/latest/developerguide/logging.html There are two possible methods to consume WAF logs: direct from a Kinesis Data Firehose stream or (if the customer has enabled Kinesis Data Firehose stream delivery to an S3 bucket, then) direct from an S3 bucket. https://docs.aws.amazon.com/waf/latest/developerguide/logging.html https://docs.aws.amazon.com/firehose/latest/dev/basic-deliver.html