Start with evidence
Before adding rules, collect CloudFront or load balancer logs and separate obvious automation from real customer paths. Production applications often suffer when crawlers hit search, account, checkout, API, or login routes too aggressively.
Use layered controls
A healthy WAF setup combines managed rule groups, scoped rate limits, IP reputation signals, and carefully chosen path conditions. Keep each rule understandable and reversible so the team can respond quickly if a campaign or integration behaves unexpectedly.
Measure the tradeoff
Watch blocked requests, origin load, cache hit ratio, checkout errors, and support reports together. A rule that lowers traffic but hurts checkout is not a win.