slug: aws-waf
provider: AWS WAF
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 4
edges:
- tag: AWS WAFV2 API
  spec_file: aws-waf-aws-wafv2-api-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: '"AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests
    forwarded to a protected resource"'
  reason: Web application firewall is unambiguously a cybersecurity control. The single generic invoke
    operation and absent schemas give no basis to choose between security architecture and threat detection
    sub-capabilities, so L1 only.
- tag: IP Sets
  spec_file: aws-waf-ip-sets-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: CreateIPSet — "web application firewall that helps protect web applications and APIs against
    common web exploits and bots"
  reason: IP sets are allow/block lists used by WAF rules — a security control configuration. Cybersecurity
    Management at L1; no sub-capability clearly indicated.
- tag: Rule Groups
  spec_file: aws-waf-rule-groups-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: CreateRuleGroup with schemas "VisibilityConfig, Rule" in a "web application firewall" API
  reason: Reusable firewall rule groups are security policy/control artefacts. Mapped to Cybersecurity
    Management at L1 only.
- tag: Web ACLs
  spec_file: aws-waf-web-acls-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.8
  evidence: CreateWebACL / GetWebACL / ListWebACLs — "operations for managing web ACLs, rule groups, IP
    sets, regex pattern sets"
  reason: Web ACLs define which HTTP requests are blocked or allowed at the perimeter — a preventive cybersecurity
    control. L1 only, as it spans secure design and threat blocking.