Summary
AWS WAF can block up to 10,000 IP addresses for a single rate-based rule instance.
1
If more than 10,000 addresses exceed the rate limit, AWS WAF blocks those with the highest rates.
1
According to