Skip to content
Sencai.docs

WAF & DDoS

Edge protection in Sencai is split across three screens, and they don’t all work the same way - two manage configuration at your cloud provider, one is a records-only planning layer today. Read the distinction below before relying on any of them.

WAF Rules - a records-only layer

Section titled “WAF Rules - a records-only layer”

Security → WAF Rules (/gravity/networks/waf) lets you define individual firewall rules (rate limits, IP blocks, geo blocks, header checks, SQL injection / XSS protection, or a custom rule) and associate each one with a provider - AWS, Azure, GCP, Cloudflare, or “Manual.”

WAF ACLs - provider sync

Section titled “WAF ACLs - provider sync”

Security → WAF ACLs (/gravity/waf) is a different, sibling feature: it imports an existing Web ACL from AWS WAFv2, Azure Front Door, or Cloudflare, using a cloud account you’ve connected, and manages its rules from there.

  • Import ACL fetches the ACL from your provider, using the account/credential and the ACL’s provider-native ID (an ARN for AWS, for example) that you supply.
  • Adding or removing a rule on an imported ACL adds or removes that rule at the provider, synchronously.

Because this screen changes firewall behavior at your provider’s edge, importing an ACL and adding or removing its rules requires at least Member; removing an ACL from Sencai’s tracking (which, again, doesn’t touch the ACL at your provider) requires Admin or Owner.

DDoS protection posture

Section titled “DDoS protection posture”

Security → DDoS (/gravity/security/ddos) shows the current DDoS protection status of your cloud resources - AWS Shield, Azure DDoS Protection, or Cloudflare - read directly from your provider.

  • Run scan reads the DDoS protection state of every protected resource under a chosen cloud account and creates or updates a posture row per resource.
  • Refresh re-reads a single resource’s current state.

There’s no create or delete action on this screen - a posture row only ever exists as the result of a scan or refresh, since it’s a live read of your provider’s own configuration rather than something Sencai manages on your behalf. The recommendation shown for each resource is derived from its provider and protection level.

Which screen should I use?

Section titled “Which screen should I use?”
  • If you manage your WAF configuration directly with your cloud provider today and want Sencai’s other security screens (findings, audit trail) to reflect it, WAF ACLs is the one that reads and writes your provider’s configuration.
  • If you’re documenting or planning rules before they exist anywhere, WAF Rules works as a record, with the caveat above that it doesn’t enforce anything on its own.

What’s next

Section titled “What’s next”