Standard Traffic Rules vs WAF Traffic Rules in AEM as a Cloud Service

Adobe Experience Manager (AEM) as a Cloud Service offers an enterprise-grade, secure, and scalable environment for delivering digital experiences. One of the key aspects of maintaining that security and performance is the ability to define and manage

Two major rule sets manage this behavior: Standard Traffic Rules and Web Application Firewall (WAF) Traffic Rules. While they might sound similar, they serve distinct purposes within Adobe’s Cloud Manager and the underlying Adobe I/O Runtime and Fastly CDN architecture.

WAF traffic filter rules require an additional WAF-DDoS Protection or Enhanced Security license. Standard traffic filter rules are available to Sites and Forms customers by default.

 

---

Understanding Traffic Rules in AEM Cloud

Traffic rules in AEM as a Cloud Service act as a control layer that filters, redirects, or restricts HTTP traffic before it reaches your author or publish environments. These rules are applied at the CDN and dispatcher levels, ensuring optimized performance and security across environments — dev, stage, and prod.

---

What Are Standard Traffic Rules?

Standard Traffic Rules are configuration-level rules that control the behavior of traffic — not necessarily to block it, but to redirect, rewrite, or allow it conditionally.

Typical Use Cases

• Redirecting traffic from HTTP → HTTPS.
  
  
  
• Defining vanity URLs or SEO-friendly redirects.
• Restricting access to author instances from public networks.
• Allowing traffic only from specific IP ranges for certain paths.
• Applying geo-based routing or maintenance page redirection.

How They Work

These rules are defined and managed via AEM Cloud Manager under the Environment Configuration section. They leverage Adobe’s edge configuration capabilities, meaning requests are filtered before they hit the AEM dispatcher layer, minimizing load and latency.

rules:
  - name: redirectToHTTPS
    when:
      condition: request.scheme == "http"
    action:
      type: redirect
      url: "https://${request.host}${request.path}"
      status: 301

Key Goal: Optimize routing and performance, control access, and ensure consistent user experience.

---

What Are WAF (Web Application Firewall) Traffic Rules?

WAF Traffic Rules focus purely on security. They protect AEM environments against malicious attacks, bots, and exploits such as:

• SQL Injection
• Cross-Site Scripting (XSS)
• DDoS attacks
• Path traversal or request forgery

Adobe’s WAF is powered by Fastly’s edge security services, providing real-time inspection and blocking of malicious requests before they enter the AEM infrastructure.

Typical Use Cases

• Blocking suspicious user agents or crawlers.
• Enforcing rate limiting to prevent DDoS.
• Preventing uploads with disallowed file types.
• Mitigating known CVEs or OWASP Top 10 vulnerabilities.

How They Work

WAF rules analyze request headers, body content, IP, and payload patterns. You can define custom rule exceptions in Cloud Manager or rely on Adobe-managed default protection policies.

rules:
  - name: blockSQLInjection
    when:
      condition: request.query contains "select%20from" or "union%20all"
    action:
      type: block

Key Goal: Protect AEM from external threats and vulnerabilities while maintaining availability and compliance.

---

Standard vs WAF Traffic Rules — Comparison Table

Feature / Aspect	Standard Traffic Rules	WAF Traffic Rules
License	Available by default	Requires add-on license
Primary Purpose	Control routing, access, and optimization	Block malicious or suspicious traffic
Focus Area	Functional behavior	Security enforcement
Managed By	Developers / Cloud Admins	Adobe Security / Admins
Examples	Redirects, IP allow-list, maintenance mode	SQL injection, XSS, DDoS, bot filtering
Configuration Scope	Project-level or environment-level	Global or environment-level
Where Applied	Edge/CDN before AEM dispatcher	WAF Layer (Fastly Edge Security)
Performance Impact	Improves routing and response time	Protects at slight inspection overhead
Customization	High (YAML configuration)	Moderate (Custom rule exceptions)

---

Deployment & Sync Across Environments

To ensure consistent behavior across Dev → Stage → Prod:

1. Define and version-control traffic rules in your AEM Cloud Manager Git repository.
2. Deploy via Cloud Manager pipeline to validate and apply rules.
3. Adobe-managed WAF rules are synced automatically; custom overrides can differ by environment.
4. Test in Stage before promoting to Production.

---

Best Practices

• Keep Standard Traffic Rules minimal — focus on routing and logic only.
• Let WAF handle malicious traffic; avoid duplication.
• Use environment variables for IP or domain conditions.
• Review WAF logs periodically via Adobe Support or Cloud Manager.
• Maintain version history and documentation for audit compliance.

---

Visual Flow Diagram (Text Representation)

[Client Request]
      │
      ▼
 ┌───────────────┐
 │   Fastly CDN  │
 └───────────────┘
      │
      ▼
 ┌────────────────────────────┐
 │ WAF Traffic Rules Layer     │  ← Security Filtering (malicious requests blocked)
 └────────────────────────────┘
      │
      ▼
 ┌────────────────────────────┐
 │ Standard Traffic Rules Layer│  ← Redirects, Access Control, Geo Rules
 └────────────────────────────┘
      │
      ▼
 ┌───────────────┐
 │ AEM Dispatcher │
 └───────────────┘
      │
      ▼
 ┌───────────────┐
 │  AEM Publish  │
 └───────────────┘

---

Conclusion

Both Standard Traffic Rules and WAF Traffic Rules play vital roles in securing and managing traffic in AEM as a Cloud Service.

• Use Standard Traffic Rules for operational control and routing efficiency.
• Rely on WAF Traffic Rules for proactive defense against web threats.

Together, they form a multi-layered security and traffic governance framework that ensures high availability, compliance, and seamless digital experiences.

---

Tags: AEM Cloud, Adobe Experience Manager, WAF, Traffic Rules, Cloud Security, Fastly CDN, AEM DevOps