AWS — WAF

What is WAF?

Protects web applications from common attacks.

Create web ACL

aws wafv2 create-web-acl \
  --name my-web-acl \
  --scope REGIONAL \
  --default-action Allow={} \
  --rules '[
    {
      "Name": "RateLimit",
      "Priority": 1,
      "Statement": {"RateBasedStatement": {"Limit": 1000, "AggregateKeyType": "IP"}},
      "Action": {"Block": {}},
      "VisibilityConfig": {"SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "RateLimit"}
    }
  ]' \
  --visibility-config 'SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=my-web-acl'

Common rules

Rule	Protection
SQL Injection	SQL attacks
XSS	Cross-site scripting
IP Reputation	Known bad IPs
Rate Limiting	DDoS protection

Associate with ALB

aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:123456789:regional/webacl/my-web-acl/xxx \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123456789:loadbalancer/app/my-alb/xxx

Custom rules

import boto3

waf = boto3.client('wafv2')

# Create rule
rule = {
    'Name': 'CustomRule',
    'Priority': 1,
    'Statement': {
        'ByteMatchStatement': {
            'SearchString': 'bad-input',
            'FieldToMatch': {'Body': {}},
            'TextTransformations': [{'Priority': 0, 'Type': 'LOWERCASE'}]
        }
    },
    'Action': {'Block': {}}
}

Best practices

1. Use managed rule groups
2. Enable logging
3. Test with count mode
4. Monitor with CloudWatch

Mini Practice

1. Create a web ACL
2. Add rate limiting rule
3. Associate with ALB
4. Test and monitor

Up Next

Continue with Shield - DDoS Protection.