AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Authenticate legitimate AI agent traffic with AWS WAF Bot Control

infonews

security

Source: AWS Security BlogJuly 14, 2026

Summary

AWS WAF Bot Control now includes Web Bot Authentication (WBA), a security feature that uses cryptographic signatures (mathematical verification codes created with public and private keys) to confirm that automated bot traffic comes from legitimate sources. Traditional methods like IP-based filtering fail in multi-tenant systems (shared environments where many different services use the same IP address) where attackers can easily fake their identity, but WBA solves this by having bot operators sign their requests with cryptographic keys that AWS WAF can verify at the edge.

Solution / Mitigation

AWS WAF Bot Control implements Web Bot Authentication (WBA) using asymmetric cryptography and HTTP Message Signatures (RFC 9421). The solution works through: (1) Bot registration, where bot operators publish their public keys in a signature directory that AWS WAF regularly polls; (2) Request signing, where each bot request is signed using the operator's private key following IETF standards; (3) Verification, where AWS WAF verifies signatures against known public keys and appends labels (verified, invalid, expired, or unknown_bot) to allow granular control through WAF rules. AWS WAF Bot Control respects WBA verification status by default, automatically allowing verified AI agent traffic.