Edge rate limits on the sign-in endpoints, and managed bad-address lists

Description

After OPS-41. First layer of Confluence ENG › ADR-014: Sign-in rate limits at the edge and per account.

AWS WAF rate-based rules on the sign-in endpoints, per IP address, in all three regions.
AWS managed lists of known bad addresses on the same endpoints.
The temporary network blocks from the night of OPS-41 removed once the rate rules hold.
Tune after a week of real traffic, and again when the lockout (ENG-1702) ships.

relates to OPS-41 Credential stuffing against password sign-in in the EU: about 1.9 million attempts Done
relates to ENG-1702 Sign-in lockout and rate limits Done
relates to OPS-43 Sign-in lockout and rate limits: release in every region, Thursday 07:00 Done

Oskar Lund · 4 Sep 2026, 14:10 UTC

Live in all regions since 15:30. Temporary network blocks removed.

Oskar Lund · 10 Sep 2026, 10:15 UTC

Tuned after the lockout went live this morning. Closing.