Bird
Raised Fist0
AWScloud~5 mins

AWS WAF for web application firewall - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
Web applications can be attacked by bad traffic that tries to break them or steal data. AWS WAF helps protect your web apps by blocking harmful traffic before it reaches your servers.
When you want to block common attacks like SQL injection or cross-site scripting on your website.
When you need to control which IP addresses can access your web application.
When you want to monitor and log web traffic to detect suspicious activity.
When you want to protect your app from bots or automated attacks.
When you want to set rules that allow or block traffic based on specific patterns.
Config File - waf-web-acl.json
waf-web-acl.json
{
  "Name": "example-web-acl",
  "Scope": "REGIONAL",
  "DefaultAction": { "Allow": {} },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "exampleWebACL"
  },
  "Rules": [
    {
      "Name": "BlockSQLInjection",
      "Priority": 1,
      "Statement": {
        "SqliMatchStatement": {
          "FieldToMatch": { "UriPath": {} },
          "TextTransformations": [
            { "Priority": 0, "Type": "URL_DECODE" }
          ]
        }
      },
      "Action": { "Block": {} },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "blockSQLInjection"
      }
    }
  ]
}

This JSON file defines a Web ACL (Access Control List) named example-web-acl for regional resources like an Application Load Balancer.

The DefaultAction allows all traffic unless blocked by rules.

The Rules section includes one rule that blocks requests with SQL injection attempts in the URL path.

VisibilityConfig enables monitoring and logging for the ACL and its rules.

Commands
This command creates the Web ACL in AWS WAF using the JSON configuration file. It sets up the firewall rules to protect your web app.
Terminal
aws wafv2 create-web-acl --cli-input-json file://waf-web-acl.json
Expected OutputExpected
{ "Summary": { "Name": "example-web-acl", "Id": "12345678-1234-1234-1234-123456789012", "ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/example-web-acl/12345678-1234-1234-1234-123456789012" } }
→
--cli-input-json - Specifies the JSON file with the Web ACL configuration
This command lists all Web ACLs in the regional scope to verify that your Web ACL was created successfully.
Terminal
aws wafv2 list-web-acls --scope REGIONAL
Expected OutputExpected
{ "WebACLs": [ { "Name": "example-web-acl", "Id": "12345678-1234-1234-1234-123456789012" } ] }
→
--scope - Specifies the scope of the Web ACLs to list (REGIONAL for ALB, CLOUDFRONT for global)
This command retrieves details of the Web ACL to check its rules and settings.
Terminal
aws wafv2 get-web-acl --name example-web-acl --scope REGIONAL --id 12345678-1234-1234-1234-123456789012
Expected OutputExpected
{ "WebACL": { "Name": "example-web-acl", "Id": "12345678-1234-1234-1234-123456789012", "DefaultAction": { "Allow": {} }, "Rules": [ { "Name": "BlockSQLInjection", "Priority": 1, "Action": { "Block": {} } } ] } }
→
--name - Specifies the name of the Web ACL
→
--scope - Specifies the scope of the Web ACL
→
--id - Specifies the ID of the Web ACL
Key Concept

If you remember nothing else from this pattern, remember: AWS WAF lets you create rules that block bad web traffic before it reaches your app.

Common Mistakes
Using the wrong scope value when creating or listing Web ACLs.
AWS WAF has two scopes: REGIONAL for resources like Application Load Balancers and CLOUDFRONT for global CloudFront distributions. Using the wrong scope causes commands to fail or not find your Web ACL.
Always use --scope REGIONAL for ALB and --scope CLOUDFRONT for CloudFront when creating, listing, or getting Web ACLs.
Not enabling visibility configuration in the Web ACL JSON.
Without visibility settings, you cannot monitor or log the traffic that matches your rules, making it hard to know if your firewall is working.
Always include VisibilityConfig with SampledRequestsEnabled and CloudWatchMetricsEnabled set to true.
Forgetting to specify the correct Web ACL ID when retrieving or updating it.
The ID uniquely identifies the Web ACL. Without it, AWS CLI commands will fail or target the wrong resource.
Use the ID returned when you create the Web ACL or list existing Web ACLs.
Summary
Create a Web ACL using a JSON file that defines rules to block harmful web traffic.
Use AWS CLI commands to create, list, and get details of your Web ACL to verify it is set up correctly.
Remember to use the correct scope and enable visibility to monitor your firewall's activity.

Practice

(1/5)
1. What is the main purpose of AWS WAF (Web Application Firewall)?
easy
A. To store large amounts of data securely
B. To manage virtual machines in the cloud
C. To protect web applications by filtering and blocking harmful web traffic
D. To monitor network bandwidth usage

Solution

  1. Step 1: Understand AWS WAF's role

    AWS WAF is designed to protect web applications by filtering incoming HTTP requests based on rules.

  2. Step 2: Compare options with AWS WAF function

    Only To protect web applications by filtering and blocking harmful web traffic describes filtering and blocking harmful web traffic, which matches AWS WAF's purpose.

  3. Final Answer:

    To protect web applications by filtering and blocking harmful web traffic -> Option C

  4. Quick Check:

    AWS WAF = Web traffic protection [OK]
Hint: AWS WAF filters web traffic to protect apps [OK]
Common Mistakes:
  • Confusing AWS WAF with storage services
  • Thinking AWS WAF manages virtual machines
  • Assuming AWS WAF monitors bandwidth
2. Which of the following is the correct way to create a rule in AWS WAF to block requests from a specific IP address?
easy
A. Use AWS Shield to block the IP address
B. Directly add the IP address to the Web ACL without a rule
C. Create a Lambda function to block the IP address
D. Create an IP set with the IP address, then add a rule to block requests matching that IP set

Solution

  1. Step 1: Understand AWS WAF rule creation

    In AWS WAF, you create an IP set containing IP addresses, then create a rule that uses this IP set to block matching requests.

  2. Step 2: Evaluate options for correctness

    Create an IP set with the IP address, then add a rule to block requests matching that IP set correctly describes creating an IP set and a rule. Options B, C, and D do not follow AWS WAF's process.

  3. Final Answer:

    Create an IP set with the IP address, then add a rule to block requests matching that IP set -> Option D

  4. Quick Check:

    IP set + rule = block IP [OK]
Hint: Use IP sets with rules to block IPs in AWS WAF [OK]
Common Mistakes:
  • Trying to block IPs directly in Web ACL without rules
  • Confusing AWS WAF with Lambda or Shield
  • Skipping IP set creation
3. Given this AWS WAF rule configuration snippet:
{"Name": "BlockBadBots", "Priority": 1, "Action": {"Block": {}}, "Statement": {"ByteMatchStatement": {"SearchString": "BadBot", "FieldToMatch": {"UriPath": {}}, "TextTransformations": [{"Priority": 0, "Type": "NONE"}]}}}
What will happen when a request URI contains the text "BadBot"?
medium
A. The rule will cause an error and not apply
B. The request will be blocked by AWS WAF
C. The request will be logged but allowed
D. The request will be allowed without filtering

Solution

  1. Step 1: Analyze the ByteMatchStatement

    The rule looks for the string "BadBot" in the URI path and blocks the request if found.

  2. Step 2: Understand the action on match

    The action is "Block", so any request matching the condition will be blocked.

  3. Final Answer:

    The request will be blocked by AWS WAF -> Option B

  4. Quick Check:

    Match "BadBot" in URI = block request [OK]
Hint: ByteMatch with Block action blocks matching requests [OK]
Common Mistakes:
  • Assuming requests are allowed by default
  • Confusing Block with Count or Allow actions
  • Thinking the rule causes errors
4. You created an AWS WAF rule to block requests from IP 203.0.113.5, but requests from this IP are still allowed. What is the most likely cause?
medium
A. The Web ACL is not associated with the resource
B. AWS WAF does not support blocking IP addresses
C. The IP address was not added to the IP set used by the rule
D. The rule action is set to Allow instead of Block

Solution

  1. Step 1: Check IP set and rule configuration

    If the IP was not added to the IP set or the rule action was wrong, blocking would fail, but these are common mistakes.

  2. Step 2: Verify Web ACL association

    Even if rules are correct, if the Web ACL is not linked to the web resource (like CloudFront or ALB), rules won't apply.

  3. Final Answer:

    The Web ACL is not associated with the resource -> Option A

  4. Quick Check:

    Web ACL association needed for rules to apply [OK]
Hint: Always associate Web ACL with resource to enforce rules [OK]
Common Mistakes:
  • Forgetting to associate Web ACL with the resource
  • Assuming AWS WAF can't block IPs
  • Setting wrong rule action
5. You want to protect your web app from SQL injection and block requests from a list of suspicious IPs. Which AWS WAF setup is best?
hard
A. Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs
B. Use only an IP set rule to block suspicious IPs, ignoring SQL injection
C. Create a Lambda function to inspect requests and block SQL injection
D. Enable AWS Shield Advanced to block SQL injection and IPs

Solution

  1. Step 1: Identify protection needs

    You need to block SQL injection attacks and block suspicious IP addresses.

  2. Step 2: Choose AWS WAF features

    AWS WAF provides managed rule groups for SQL injection and supports IP set rules for blocking IPs.

  3. Step 3: Evaluate options

    Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs combines managed SQL injection rules and custom IP set blocking, which is best practice. Options B, C, and D do not fully meet requirements or use incorrect services.

  4. Final Answer:

    Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs -> Option A

  5. Quick Check:

    Managed rules + IP sets = full protection [OK]
Hint: Combine managed rules with IP sets for layered protection [OK]
Common Mistakes:
  • Using only IP blocking without SQL injection rules
  • Relying on Lambda or Shield for WAF tasks
  • Not combining rules in one Web ACL
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard