WAF (Web Application Firewall) with preconfigured CloudFormation template and Web ACL for CloudFront distribution

bogotobogo.com site search:

What is WAF?

WAF is a web application firewall that lets us monitor the HTTP and HTTPS requests that are forwarded to CloudFront, Application Load Balancer or API Gateway.

WAF also lets us control access to our content. Based on conditions that we specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront, Application Load Balancer or API Gateway responds to requests either with the requested content or with an HTTP 403 status code (Forbidden).

For more details, see What Is AWS WAF and AWS Shield?

Pics credit : SlideShare

How can I deploy preconfigured protections using AWS WAF?

We can start from preconfigured WAF:

Configuring a web application firewall strategy can be challenging and burdensome to large and small organizations alike, especially for those who do not have dedicated security teams. To simplify this process, AWS offers a solution that uses AWS CloudFormation to automatically deploy a set of AWS WAF rules designed to filter common web-based attacks. Users can select from preconfigured protective features that define the rules included in an AWS WAF web access control list (web ACL), as depicted in the image to the right. Once the solution is deployed, AWS WAF will begin inspecting web requests to the user's existing Amazon CloudFront distributions, and block them when applicable.

We can use the following link for CloudFormation template (https://s3.amazonaws.com/solutions-reference/aws-waf-security-automations/latest/aws-waf-security-automations.template) which we can get it from Automated Deployment.

We can just paste it on the "Select Template" page and choose "Next":

On the "Specify Details" page, assign a name to AWS WAF configuration in the Stack name field. This will also be the name of the web ACL that the template creates. Then, type in "CloudFront Access Log Bucket Name" which is one of the two required field to fill.

On the "Review page", review and confirm the settings. Be sure to check the box acknowledging that the template will create AWS Identity and Access Management (IAM) resources. Then, choose "Create" to deploy the stack.

Here we have our stack:

To see details for the stack resources, choose the "Outputs" tab:

Creating or Updating a Web Distribution

To proceed, we're supposed to use Amazon CloudFront to deliver content for our web application. So, if we don't already have a CloudFront distribution, we will need to configure one to distribute both static and dynamic content of our web application. Refer to the Amazon CloudFront Developer Guide to complete the following steps.

Let's start from the CloudFront console at https://console.aws.amazon.com/cloudfront/.
Choose "Create Distribution".
On the first page of the "Create Distribution Wizard", in the "Web" section, choose "Get Started".
Specify settings for the distribution. (see Values that You Specify When You Create or Update a Web Distribution).

Save changes.
After CloudFront creates our distribution, the value of the "Status" column for our distribution will change from "InProgress" to "Deployed".

If we chose to enable the distribution, it will then be ready to process requests.
The domain name that CloudFront assigns to our distribution appears in the list of distributions. (It also appears on the "General" tab for a selected distribution.)
When our distribution is deployed, confirm that we can access our content using our new CloudFront URL or CNAME.

Associating CloudFront Distribution with the Web ACL

Open the Amazon CloudFront console and choose the distribution that we want to update.
Choose "Distribution Settings", and on the "General" tab, choose "Edit".
For AWS WAF Web ACL, choose the web ACL the solution created (the same name we assigned to the stack during initial configuration).
For "Logging", choose "On".
For "Bucket for Logs", click in the field and choose the Amazon S3 bucket we want use to store CloudFront web access logs. The drop-down list enumerates the buckets associated with the current AWS account.

We also want to have the site protected by WAF. We should let our CloudFront distribution know the WAF, so select the WAF we've just created for "AWS WAF Web ACL":