Infrastructure Security – Keeping Your VPC secure – Microsoft AWS

Configuring AWS WAF for web application protection

AWS WAF is a crucial tool in the AWS security suite that provides a line of defense against web-based threats. It monitors HTTP and HTTPS requests forwarded to your web applications and allows you to control access to your content based on the criteria you specify. This could be anything from the originating IP addresses of requests to the values of query strings. Depending on your rules, the service associated with your protected resource responds to requests either with the requested content, with a forbidden response (HTTP 403 status), or with a custom response, such as a captcha verification.

The importance of having a WAF in place cannot be overstated. Often, web applications are launched without a WAF, leaving them vulnerable to a variety of threats. These vulnerabilities can lead to unauthorized access to data, loss of data, and even a complete system compromise. By implementing AWS WAF, you add an additional layer of security that can help protect your applications from these threats.

When it comes to selecting the right rules for your environment, consider the specific threats your application is most likely to face. AWS WAF enables the creation of custom rules to block specific web exploits relevant to your environment. Additionally, it offers managed rule groups for pervasive web threats such as bot traffic and account takeover fraud, among others.

These managed rule groups can be used alongside your custom rules to provide comprehensive protection for your applications. The choice between using free and paid managed rules depends on your specific needs and budget. Free rules offer basic protection against common threats, while paid rules provide more advanced features and greater flexibility. It is also important to understand which managed rules apply to your environment. For instance, the SQL database managed rule group is only applicable if your web application uses a relational database but would not protect the application in case it only uses a NoSQL database, such as DynamoDB. Selecting unwanted rules unnecessarily increases the number of web ACL capacity units (WCUs) used, leading to higher costs and limiting the capacity for more relevant rules.

Custom rules offer the greatest level of flexibility and control. They allow you to define conditions based on IP addresses, HTTP headers, methods, URI strings, and HTTP bodies that you want to allow or block. This can be particularly useful if your application has unique security requirements or if you need to address specific threats that are not covered by the preconfigured rules. However, it can be very time-consuming to fine-tune the right custom rules for your environment. It is generally a good idea to select appropriately managed rules as a basis and to complement them with custom rules if deemed relevant.

AWS WAF can protect a variety of AWS resources, including Amazon CloudFront distributions, Amazon API Gateway REST APIs, ALBs, AWS AppSync GraphQL APIs, Amazon Cognito user pools, and more.

Here is a step-by-step guide on how to configure AWS WAF for web application protection:

1. Create a web ACL: The first step in configuring AWS WAF is to create a web ACL. This is essentially a container for your rules and acts as a standard ACL. It allows you to group and manage related rules.
2. Define rules: Once you have a web ACL, you can start defining rules. The rules specify the conditions under which AWS WAF should allow, block, or count web requests. AWS WAF evaluates rules in the order they are set. Be mindful of the WCU count associated with each rule to keep costs under control and stay within the capacity limit per web ACL (at the time of writing, this is 5,000 WCUs).
3. Add conditions to rules: Each rule contains a set of conditions that specify the parts of web requests to inspect. You can also specify whether to allow, block, or count web requests that match these conditions.
4. Associate the web ACL with a resource: After you have defined your web ACL and rules, you need to associate the web ACL with the AWS resource that you want to protect, such as an Amazon CloudFront distribution or an ALB.
5. Validate and test: Once your web ACL is associated with a resource, AWS WAF starts inspecting web requests to that resource and performs the corresponding action for each rule that a web request matches. You can then validate and test your rules to ensure they are working as expected, which can be done by generating test traffic that matches the conditions of your rules and monitoring the response. You can use common web application security testing tools to perform these tests. AWS WAF provides real-time metrics and captures raw requests, which can be used to verify that your rules are correctly identifying and responding to threats.
6. Monitor and adjust: Once you have implemented AWS WAF, you can monitor the requests that AWS WAF inspects and blocks using Amazon CloudWatch and AWS WAF reports. Based on this information, you can adjust your rules and conditions as needed to address new threats and to ensure they continue to meet your security needs.