AWS WAF application firewall rules can be based on:
IP addresses
HTTP headers
HTTP message body
Custom URIs