title: Blocking a spam attack using WAF
body: <p>I have a website behind hosted on S3 behind the cloudfront. I get continuous spamming for couple of hours every evening. The spammer uses different IPs/subnets to launch the same. Going through the access logs, I can not identify any common pattern or special request origin. What kind of further digging is needed to create a WAF rule to avoid this. What is the maximum damage I am seeing here [apart from cloudfront transfer costs] ?</p>
  
  <p>The IP's being used are from Amazon, which indicates that new instances or containers are being spun up to launch the same.</p>