Sold by: GajShield Infotech
Deployed on AWS
Free Trial
Web Application and API Protection (WAAP) that shields your web applications and APIs from attacks, bots, DoS and data leaks, with positive-security API validation, response data-leak prevention, machine-learning detection and one-click compliance reports. Deploy inline in minutes and pay only for the hours you run.
Overview
Image
DashBoard
Image
Real Time Security Intelligence
GAJWAF is a Web Application and API Protection (WAAP) platform that puts an intelligent security layer in front of your web applications and APIs, blocking attacks, abuse and data loss while legitimate traffic passes through untouched. Deploy it inline in minutes and manage everything from one console.
It protects against SQL injection, cross-site scripting, remote code execution, path traversal and more, using signatures plus a combined anomaly score that catches obfuscated attacks. API security adds positive-security validation from your OpenAPI specification: unknown endpoints, method tampering, bad parameters and malformed bodies are blocked, including zero-days that step outside the contract. Bot and automation defence includes browser checks, bot traps and under-attack mode. DoS and abuse are handled with per-client rate limiting and automatic bans. Account-takeover protection defends sign-in pages against credential stuffing, password spraying and brute force.
Response Data-Leak Prevention masks or blocks payment cards, Aadhaar, PAN and US Social Security numbers, private keys and cloud credentials, and withholds leaked database errors, stack traces and directory listings. Machine-learning detection flags attacks with no matching signature, and positive-security learning models each endpoint normal traffic.
Enterprise features include a sign-in and SSO gateway (LDAP/Active Directory, RADIUS, OpenID Connect) for internal apps with no code changes, one-click compliance reports for PCI DSS, HIPAA, GDPR, India DPDP, CERT-In and ISO 27001, a single web console with two-factor access, audit log, safe configuration rollback, and in-console software updates, and high-availability clustering.
Protect as many applications (sites) as you need on a single instance; add more or larger instances for more throughput. Billing is pay-as-you-go by the instance-hour through AWS, with an optional annual price.
Highlights
- Full WAAP in one appliance: OWASP-class attack blocking, OpenAPI positive-security for APIs, bot and DoS defence, account-takeover protection, malware and client-side (Magecart) protection.
- Stops data leaving your app: response DLP masks payment cards, Aadhaar, PAN and SSN, keys and leaked errors; ML detection catches novel attacks with no signature.
- Enterprise-ready and simple: SSO gateway for internal apps, one-click compliance reports (PCI DSS, HIPAA, GDPR, India DPDP, ISO 27001), a clean console with two-factor access and in-console software updates.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 22.04 LTS
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 15 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.35 |
c5.large | $0.85 |
m5.large | $0.75 |
Dimensions summary
You pay by the hour based on the EC2 instance type you run GajWAF on. Three instance sizes are available: c5.large, m5.large, and t3.medium. Each option reflects a different mix of compute, memory, and cost per hour. Pick the instance size that matches your traffic volume and performance needs. The software runs inline in front of your applications, so sizing follows your throughput requirements. Billing accrues only for the hours each instance runs, with no upfront commitment across these three choices.
Top-of-mind questions for buyers
Each name is an EC2 instance type with a different compute and memory mix. c5.large favors compute, m5.large balances compute and memory, and t3.medium offers burstable performance. Pick the one matching your traffic volume. The software adds about 0.2 ms inspection latency per request inline.
Software charges accrue per hour only while the instance runs. A fully stopped instance stops accruing hourly software charges. Underlying AWS storage fees may still apply for a stopped instance, but the GajWAF license meters running time only.
Billing is per instance-hour, not per application. One instance supports multiple sites and virtual hosts, so you can protect several web apps and APIs on the same running instance. You pay for the instance size and hours, regardless of how many sites sit behind it.
www.gajshield.com
Helpful?
Vendor refund policy
GajShield GAJWAF Pay-as-You-Go charges are based on AWS Marketplace usage. Customers may stop usage anytime; incurred charges are generally non-refundable. Refund requests for billing errors, duplicate charges or material software defects will be reviewed by GajShield. Approved refunds are processed through AWS Marketplace. AWS infrastructure charges are governed by AWS policies. Contact GajShield Support with subscription and billing details for refund requests.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
GAJWAF 2.37.4 - Web Application and API Protection (WAAP) on AWS Marketplace.
Included in this version:
- Threat protection: blocks SQL injection, cross-site scripting, remote code execution, path traversal and more, via signatures plus a combined anomaly score.
- API security (positive model): validates requests against your OpenAPI specification and blocks unknown endpoints, method tampering, bad or injected parameters and malformed bodies.
- Bot and DoS defence: browser verification, bot traps, under-attack mode, per-client rate limiting and automatic bans.
- Account-takeover protection for sign-in pages (credential stuffing, password spraying, brute force).
- Response Data-Leak Prevention: masks or blocks payment cards, Aadhaar, PAN and US Social Security numbers, private keys and cloud credentials; withholds leaked database errors and stack traces.
- Machine-learning detection and positive-security learning for novel attacks.
- Client-side (Magecart) protection, defacement monitoring, and malware scanning of uploads.
- Sign-in and SSO gateway (LDAP/Active Directory, RADIUS, OpenID Connect) for internal apps.
- One-click compliance reports (PCI DSS, HIPAA, GDPR, India DPDP, CERT-In, ISO 27001).
- Single web console with two-factor access, audit log, safe configuration rollback and in-console software updates.
Additional details
Usage instructions
After launch, GAJWAF (Web Application and API Protection) starts automatically.
- Security group: allow inbound 80 and 443 from your clients. Add 9443 (admin console) and 22 (SSH) ONLY from your management network; do not open them to the Internet.
- Connect over SSH with your key pair: ssh -i <your-key.pem> ubuntu@<instance-public-ip>
- Retrieve the initial console sign-in created on first boot: sudo cat /var/lib/waf/initial-admin-token.txt It shows user "admin" and a one-time password.
- Open the management console (self-signed TLS on first use): https://<instance-public-ip>:9443/ Sign in as "admin" with that password. You are required to set a new password immediately.
- Add your site(s): the host name(s) and the backend server(s) GAJWAF should protect. Start in Detect mode, then switch to Block. Add as many sites as you need.
- For more throughput or high availability, launch additional or larger instances and cluster them from the console.
Ports: 80/443 protected web traffic; 9443 admin console (management only); 22 SSH (management only). Support: support@gajshield.com
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Defend against known and zero-day threats with machine learning-enhanced web app and API protection.
Subscribe to start your FREE 30-DAY FULLY-FEATURED TRIAL* and let FortiAppSec Cloud start defending your web applications and APIs in minutes.
The Cequence Managed Web Application and API Protection (WAAP) solution combines the discovery, compliance posture management, bot management, and threat protection capabilities of Cequence with the DDoS and WAF capabilities of AWS WAF to protect all your web and API applications against modern threats and bot attacks.
FortiWeb web application firewall defends your web applications and APIs, leveraging AI-based machine learning that models your applications and APIs to block malicious anomalies, control bot traffic, and identify the most important threats.
Application Protection Advanced is a cloud native WAF that secures apps and APIs against the OWASP Top 10, DDoS, Zero day attacks, and more, with 1 touch deployment for complete protection control.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.