WAF Classic: https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html

WAF Standard: https://docs.aws.amazon.com/waf/latest/developerguide/logging.html

There are two possible methods to consume WAF logs: direct from a Kinesis Data Firehose stream or (if the customer has enabled Kinesis Data Firehose stream delivery to an S3 bucket, then) direct from an S3 bucket.