As teams race to shore up application security issues in their enterprise, a web application firewall (WAF) can be an indispensable tool in the hands of a good engineer. A WAF can perform virtual patching, prevent vulnerabilities in your internally developed applications, slow down attackers, and prevent basic reconnaissance. Unfortunately, someone has to install them. Even more unfortunately, that someone was me. I will share how I built the system using the AWS WAF in Terraform along with some basics of what a WAF does, what some of the pitfalls are, how to troubleshoot your WAF during the rollout, and how to figure out if you’ve made a horrible mistake. This presentation is appropriate for attendees who have no experience with web application security or WAFs, attendees wishing to gain a better understanding of web application vulnerabilities, and those interested in the AWS WAF and WAF management.