In today’s landscape, web applications are constantly targeted by exploits such as SQL injection, cross-site scripting (XSS), and malicious bot networks. AWS WAF (Web Application Firewall) is a powerful, managed service that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources.
In this blog post, we will walk through what AWS WAF is, how it works, and how to manually set it up in the AWS Management Console to protect an Application Load Balancer (ALB).
## What is AWS WAF?
AWS WAF allows you to monitor HTTP and HTTPS requests forwarded to an Amazon API Gateway API, Amazon CloudFront distribution, or an Application Load Balancer. It enables you to control access to your content by configuring rules that allow, block, or monitor (count) web requests based on conditions you define.
### Key Benefits
– **Protection against common attacks:** Mitigates SQL injection, XSS, and more using AWS Managed Rules.
– **Customizable rules:** Block or allow traffic based on IP addresses, HTTP headers, URI strings, or geographic locations.
– **Bot control:** Detect and manage pervasive bot traffic.
– **Visibility:** Real-time metrics and sampled requests via Amazon CloudWatch.
## Architecture Overview
A typical implementation involves placing AWS WAF in front of your public-facing resources.
“`text
User / Internet
│
▼
AWS WAF (Web ACL)
│ (Filters malicious traffic)
▼
Application Load Balancer (ALB)
│
▼
EC2 Target Group (Your Web Servers)
“`
By attaching a Web Access Control List (Web ACL) to your ALB, AWS WAF inspects incoming requests before they ever reach your EC2 instances.
## Step-by-Step Guide: Setting Up AWS WAF
Let’s walk through creating a Web ACL and attaching it to an existing Application Load Balancer.
### Step 1: Navigate to AWS WAF
1. Log in to the AWS Management Console.
2. In the search bar, type **WAF & Shield** and open the service.
3. On the left navigation pane, click on **Web ACLs**.
### Step 2: Create a Web ACL
1. Click the **Create web ACL** button.
2. **Name:** Enter a descriptive name, e.g., `MyWebProtectionACL`.
3. **Resource type:** Choose **Regional resources (Application Load Balancer, API Gateway, AppSync, Cognito, App Runner, or Verified Access)**.
*(Note: If you were protecting a CloudFront distribution, you would choose “CloudFront distributions” instead).*
4. **Region:** Select the AWS Region where your ALB resides (e.g., `ap-south-1`).
5. **Associated AWS resources:** Click **Add AWS resources**.
– Select **Application Load Balancer**.
– Choose your existing ALB from the list and click **Add**.
6. Click **Next**.
### Step 3: Add Rules and Rule Groups
Rules dictate how WAF treats incoming traffic. We will add a combination of AWS Managed Rules and a custom Rate-Based rule.
1. Click **Add rules** and select **Add managed rule groups**.
2. Expand **AWS managed rule groups**.
– Find **Core rule set** and toggle it to **Add to web ACL**. (This protects against a wide range of common vulnerabilities, including OWASP Top 10).
– Find **SQL database properties** and add it if your application uses a database.
3. Click **Add rules** at the bottom of the page.
4. Now, let’s add a custom rate limit to prevent brute force or DDoS attempts. Click **Add rules** -> **Add my own rules and rule groups**.
– **Rule builder** -> **Rule type:** Rate-based rule.
– **Name:** `RateLimitRule`.
– **Rate limit:** `1000` (This limits requests from a single IP to 1000 per 5-minute period).
– **Action:** Block.
– Click **Add rule**.
5. **Default web ACL action:** Set this to **Allow**.
*(This means if a request doesn’t match any of our block rules, it is allowed through to the ALB).*
6. Click **Next**.
### Step 4: Set Rule Priority
If you have multiple rules, WAF evaluates them in order.
– Ensure your `RateLimitRule` is evaluated first, followed by the Managed Rules. You can drag and drop to reorder them.
– Click **Next**.
### Step 5: Configure Metrics
1. AWS WAF integrates tightly with Amazon CloudWatch.
2. Ensure that CloudWatch metrics are enabled for the Web ACL and for each specific rule you added.
3. Request sampling options should be enabled so you can view blocked requests directly in the WAF console.
4. Click **Next**.
### Step 6: Review and Create
1. Review all your configurations.
2. Click **Create web ACL**.
## Validating Your WAF Setup
Once the Web ACL is created and attached to your ALB, it immediately starts inspecting traffic.
1. Go to your **Web ACLs** and click on `MyWebProtectionACL`.
2. Navigate to the **Traffic overview** tab. Here you will see a graph of allowed and blocked requests over time.
3. Check the **Sampled requests** tab. If WAF is actively blocking malicious traffic (like a simulated SQL injection attempt), you will see the source IP, URI, and the specific rule that triggered the block.
**Testing a block (Simulation):**
If you want to ensure it works, try appending a SQL injection payload to your application’s URL in a browser (e.g., `http://your-alb-dns.com/?id=1′ OR ‘1’=’1`). AWS WAF’s Core Rule Set should immediately block the request and return a `403 Forbidden` error.
## Conclusion
Setting up AWS WAF is a straightforward process that drastically improves the security posture of your web applications. By combining AWS Managed Rules for baseline OWASP protection and custom rate-based rules for abuse prevention, you can effectively shield your infrastructure from malicious actors without needing to manage complex firewall appliances.