AWS WAF(Web Access Firewall)

Leave a Comment / By /

Back to: AWS-Basics-Advanced

0

AWS WAF (Web Application Firewall) — Complete Guide

🔹 Introduction

In today’s digital era, web applications are continuously exposed to security threats like SQL injection, Cross-Site Scripting (XSS), DDoS, and bot attacks.
To safeguard your applications from these attacks, AWS WAF (Web Application Firewall) acts as your first line of defense.

AWS WAF helps you monitor HTTP(S) requests, filter malicious traffic, and allow/block requests based on customizable rules.

🌍 What is AWS WAF?

AWS WAF is a web application firewall that protects web applications and APIs from common web exploits that can affect availability, compromise security, or consume excessive resources.

It allows you to control access to your web applications by defining conditions such as:

  • IP addresses

  • HTTP headers

  • Query strings

  • URI paths

  • Request body

  • Geolocation

  • Rate limiting

🧩 Where Can You Deploy AWS WAF?

AWS WAF can be associated with:

  1. Amazon CloudFront (for CDN-level protection)

  2. Application Load Balancer (ALB) (for layer 7 protection)

  3. API Gateway

  4. AWS AppSync

  5. AWS Cognito

⚙️ Components of AWS WAF

Component Description
Web ACL (Access Control List) The main container that holds rules and determines if traffic should be allowed, blocked, or counted.
Rule A single filtering condition or logic (e.g., block SQL injection).
Rule Group A reusable collection of rules.
Conditions Define match criteria like IP sets, string matching, regex, etc.
Action What to do when a request matches a rule — Allow, Block, or Count.

🧱 Types of AWS WAF

Type Description Example
AWS Managed Rules Predefined security rules managed by AWS to protect from common threats. SQLi, XSS, Bad Bots
AWS Marketplace Rules Rules provided by third-party vendors like Fortinet, Trend Micro. Bot Control, API Protection
Custom Rules Your own rules based on headers, IPs, URIs, etc. Block /admin, limit /login requests

  1. Open AWS Management Console → AWS WAF.

  2. Create a Web ACL if you don’t have one yet.

    • Click Create web ACL

    • Name: MyApp-WAF

    • Choose resource: e.g. Application Load Balancer (ALB)

    • Region: same as ALB

    • Action: Allow all traffic by default

    • Click Next → Add rules later.

Now you can start adding your custom rules 👇

🧩 Rule 1: Block Specific IP Address

Use case: Block requests from IP 1.2.3.4.

Steps:

  1. Open your Web ACL → Rules → Add rule → Add my own rules and rule groups.

  2. Rule name: Block-Specific-IP

  3. Choose Rule type: IP set match.

  4. Click Create IP set → Add 1.2.3.4/32.

  5. Select Action: Block.

  6. Save and add to Web ACL.

Test:

curl -I -X GET http://myapp.example.com --header "X-Forwarded-For: 1.2.3.4"

🧩 Rule 2: Allow Only Specific Country (India)

Use case: Allow traffic from India only.

Steps:

  1. Add new rule → Rule type: Geo match.

  2. Rule name: Allow-India

  3. Select Country: India (IN).

  4. Action: Allow

  5. Add another Default Rule: Block all (so other traffic is blocked).

Test:

curl -I -X GET http://myapp.example.com --header "CF-IPCountry: IN"

🧩 Rule 3: Block SQL Injection

Use case: Block SQL keywords like ' OR 1=1 --.

Steps:

  1. Add rule → Rule type: String match.

  2. Rule name: Block-SQL-Injection.

  3. Inspect field: Query string.

  4. Match type: Contains.

  5. Add values like:

    • ' OR 1=1

    • UNION SELECT

    • DROP TABLE

  6. Action: Block.

Test:

curl -X GET "http://myapp.example.com/login?user=admin' OR 1=1--"

🧩 Rule 4: Block Cross-Site Scripting (XSS)

Use case: Prevent script injection.

Steps:

  1. Add rule → Rule type: String match.

  2. Rule name: Block-XSS.

  3. Inspect field: Body.

  4. Match condition: Contains <script>.

  5. Action: Block.

Test:

curl -X POST -d "input=<script>alert('xss')</script>" http://myapp.example.com/comment

🧩 Rule 5: Block /admin Path

Use case: Restrict admin URLs.

Steps:

  1. Add rule → Rule type: URI Path match.

  2. Rule name: Block-Admin-Path.

  3. Inspect field: URI path.

  4. Match type: Starts with /admin.

  5. Action: Block.

Test:

curl -I http://myapp.example.com/admin

🧩 Rule 6: Block Bad User-Agent

Use case: Block scanners or bots like “sqlmap”.

Steps:

  1. Add rule → Rule type: Header match.

  2. Rule name: Block-Bad-UA.

  3. Inspect field: Header → User-Agent.

  4. Match type: Contains.

  5. Values: sqlmap, bot, crawler.

  6. Action: Block.

Test:

curl -I -A "sqlmap" http://myapp.example.com/

🧩 Rule 7: Allow Only HTTPS

Use case: Enforce secure connections.

Steps:

  1. Add rule → Rule type: Header match.

  2. Rule name: Allow-HTTPS.

  3. Inspect field: X-Forwarded-Proto.

  4. Match type: Equals https.

  5. Action: Allow.

  6. Add another rule to Block others (HTTP).

Test:

curl -I http://myapp.example.com/

(Expected: Blocked)

curl -I https://myapp.example.com/

(Expected: Allowed)

🧩 Rule 8: Rate-Limiting Login Endpoint

Use case: Limit login requests per IP.

Steps:

  1. Add rule → Rule type: Rate-based rule.

  2. Rule name: RateLimit-Login.

  3. Rate limit: 100 requests / 5 minutes.

  4. Scope: IP address.

  5. Add condition: URI Path → Contains /login.

  6. Action: Block when exceeded.

Test:

for i in {1..120}; do curl -s -o /dev/null -w "%{http_code}\n" http://myapp.example.com/login; done

🧩 Rule 9: Block Debug Query Parameter

Use case: Block ?debug=true query strings.

Steps:

  1. Add rule → Rule type: String match.

  2. Rule name: Block-Debug-Param.

  3. Inspect field: Query string.

  4. Match condition: Contains debug=true.

  5. Action: Block.

Test:

curl -I "http://myapp.example.com/?debug=true"

🧩 Rule 10: Block Custom Header (X-Block-Me)

Use case: Block any request containing a specific header.

Steps:

  1. Add rule → Rule type: Header match.

  2. Rule name: Block-Custom-Header.

  3. Inspect field: X-Block-Me.

  4. Match type: Equals yes.

  5. Action: Block.

Test:

curl -I -X GET http://myapp.example.com --header "X-Block-Me: yes"

📊 Verifying and Monitoring

Once your rules are created:

  1. Go to your Web ACL → Logging and Metrics.

  2. Enable logging to CloudWatch Logs or S3.

  3. Check request metrics under:

    • AllowedRequests

    • BlockedRequests

    • CountedRequests

This helps you verify which rules are triggering most often.

🏁 Final Words

You’ve now built a customized, layered web security defense using AWS WAF.
These rules protect your applications from common threats like:

  • IP abuse

  • SQL injection

  • XSS

  • Path-based attacks

  • Rate limiting issues

Combine these with AWS Managed Rules and AWS Shield for enterprise-grade protection.

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top