STACKIT ALB WAF is now generally available
Section titled “STACKIT ALB WAF is now generally available”We are excited to announce that the STACKIT Application Load Balancer Web Application Firewall (ALB WAF) has reached General Availability (GA) as of 04 August 2026. You can now manage production-grade ALB WAF configurations via the stable v1 API, and Terraform.
The ALB WAF is powered by the Coraza engine and inspects Layer 7 traffic on a per-listener basis. It combines a managed rule set based on the OWASP Core Rule Set with a structured JSON abstraction over SecLang, enabling you to author custom detection rules without writing raw SecLang directives.
GA scope
- API & SDK: Full support on the stable v1 API surface and updated SDKs for managing ALB WAF instances, managed rule sets, and custom rule groups.
- Terraform Provider: Resource and data source support available for infrastructure-as-code automation.
- Observability: ALB WAF records ship alongside Envoy logs under the
component="waf"label and can be routed to attached STACKIT Observability instances.
Post GA scope
- STACKIT Portal UI: Full visual interface for configuring ALB WAF instances, attaching rule sets to load balancing listeners, and tuning rule actions.
Explore our documentation to learn about basic concepts, management options, and the selector catalog: