AWS WAF for web application firewall - Mini Project: Build & Apply

AWS WAF for web application firewall

📖 Scenario: You are setting up a web application firewall (WAF) to protect a website from common web attacks like SQL injection and cross-site scripting.This firewall will filter incoming web traffic and block harmful requests before they reach your web servers.

🎯 Goal: Create an AWS WAF web ACL (Access Control List) with rules to block SQL injection and cross-site scripting attacks, then associate it with a web application resource.

📋 What You'll Learn

Create a web ACL named MyWebACL with default action to allow requests

Add a rule named BlockSQLInjection that blocks requests with SQL injection attempts

Add a rule named BlockXSS that blocks requests with cross-site scripting attempts

Associate the web ACL with a resource ARN arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4/stages/prod

💡 Why This Matters

🌍 Real World

AWS WAF protects web applications from common web exploits that could affect availability, compromise security, or consume excessive resources.

💼 Career

Cloud engineers and security specialists use AWS WAF to secure applications and meet compliance requirements.

1

Create the initial AWS WAF Web ACL resource

Create an AWS WAFv2 web ACL resource named MyWebACL with scope REGIONAL and default action to allow all requests. Use aws_wafv2_web_acl resource with default_action set to allow.

AWS

# Your code here to create aws_wafv2_web_acl resource named MyWebACL with default allow action

Hint

Use resource "aws_wafv2_web_acl" "MyWebACL" {} with default_action { allow {} }.

2

Add SQL injection blocking rule

Add a rule named BlockSQLInjection to the MyWebACL resource that blocks requests containing SQL injection attempts. Use statement { sqli_match_statement {} inside the rule. Set the rule action to block.

AWS

resource "aws_wafv2_web_acl" "MyWebACL" {
  name        = "MyWebACL"
  scope       = "REGIONAL"
  default_action {
    allow {}
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "MyWebACL"
    sampled_requests_enabled   = true
  }

  # Add rule BlockSQLInjection to block SQL injection attacks
  # Your code here
}

Hint

Inside rule {}, set name = "BlockSQLInjection", action { block {} }, and use sqli_match_statement with field_to_match { all_query_arguments {} }.

3

Add cross-site scripting blocking rule

Add another rule named BlockXSS to the MyWebACL resource that blocks requests containing cross-site scripting (XSS) attempts. Use statement { xss_match_statement {} inside the rule. Set the rule action to block and priority to 2.

AWS

resource "aws_wafv2_web_acl" "MyWebACL" {
  name        = "MyWebACL"
  scope       = "REGIONAL"
  default_action {
    allow {}
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "MyWebACL"
    sampled_requests_enabled   = true
  }

  rule {
    name     = "BlockSQLInjection"
    priority = 1
    action {
      block {}
    }
    statement {
      sqli_match_statement {
        field_to_match {
          all_query_arguments {}
        }
        text_transformation {
          priority = 0
          type     = "URL_DECODE"
        }
      }
    }
    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "BlockSQLInjection"
    }
  }

  # Add rule BlockXSS to block cross-site scripting attacks
  # Your code here
}

Hint

Inside rule {}, set name = "BlockXSS", priority = 2, action { block {} }, and use xss_match_statement with field_to_match { all_query_arguments {} }.

4

Associate the Web ACL with a resource

Create an aws_wafv2_web_acl_association resource named MyWebACLAssociation that associates the MyWebACL web ACL with the resource ARN arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4/stages/prod. Use the web_acl_arn from aws_wafv2_web_acl.MyWebACL.arn.

AWS

resource "aws_wafv2_web_acl" "MyWebACL" {
  name        = "MyWebACL"
  scope       = "REGIONAL"
  default_action {
    allow {}
  }
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "MyWebACL"
    sampled_requests_enabled   = true
  }

  rule {
    name     = "BlockSQLInjection"
    priority = 1
    action {
      block {}
    }
    statement {
      sqli_match_statement {
        field_to_match {
          all_query_arguments {}
        }
        text_transformation {
          priority = 0
          type     = "URL_DECODE"
        }
      }
    }
    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "BlockSQLInjection"
    }
  }

  rule {
    name     = "BlockXSS"
    priority = 2
    action {
      block {}
    }
    statement {
      xss_match_statement {
        field_to_match {
          all_query_arguments {}
        }
        text_transformation {
          priority = 0
          type     = "URL_DECODE"
        }
      }
    }
    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "BlockXSS"
    }
  }
}

# Create aws_wafv2_web_acl_association resource to link MyWebACL with the given resource ARN
# Your code here

Hint

Create aws_wafv2_web_acl_association resource with resource_arn set to the given ARN and web_acl_arn set to aws_wafv2_web_acl.MyWebACL.arn.

Practice

1. What is the main purpose of AWS WAF (Web Application Firewall)?

easy

A. To store large amounts of data securely

B. To manage virtual machines in the cloud

C. To protect web applications by filtering and blocking harmful web traffic

D. To monitor network bandwidth usage

Solution

1. Step 1: Understand AWS WAF's role

   AWS WAF is designed to protect web applications by filtering incoming HTTP requests based on rules.

2. Step 2: Compare options with AWS WAF function

   Only To protect web applications by filtering and blocking harmful web traffic describes filtering and blocking harmful web traffic, which matches AWS WAF's purpose.

3. Final Answer:

   To protect web applications by filtering and blocking harmful web traffic -> Option C

4. Quick Check:

   AWS WAF = Web traffic protection [OK]

Hint: AWS WAF filters web traffic to protect apps [OK]

Common Mistakes:

• Confusing AWS WAF with storage services
• Thinking AWS WAF manages virtual machines
• Assuming AWS WAF monitors bandwidth

2. Which of the following is the correct way to create a rule in AWS WAF to block requests from a specific IP address?

easy

A. Use AWS Shield to block the IP address

B. Directly add the IP address to the Web ACL without a rule

C. Create a Lambda function to block the IP address

D. Create an IP set with the IP address, then add a rule to block requests matching that IP set

Solution

1. Step 1: Understand AWS WAF rule creation

   In AWS WAF, you create an IP set containing IP addresses, then create a rule that uses this IP set to block matching requests.

2. Step 2: Evaluate options for correctness

   Create an IP set with the IP address, then add a rule to block requests matching that IP set correctly describes creating an IP set and a rule. Options B, C, and D do not follow AWS WAF's process.

3. Final Answer:

   Create an IP set with the IP address, then add a rule to block requests matching that IP set -> Option D

4. Quick Check:

   IP set + rule = block IP [OK]

Hint: Use IP sets with rules to block IPs in AWS WAF [OK]

Common Mistakes:

• Trying to block IPs directly in Web ACL without rules
• Confusing AWS WAF with Lambda or Shield
• Skipping IP set creation

3. Given this AWS WAF rule configuration snippet:
{"Name": "BlockBadBots", "Priority": 1, "Action": {"Block": {}}, "Statement": {"ByteMatchStatement": {"SearchString": "BadBot", "FieldToMatch": {"UriPath": {}}, "TextTransformations": [{"Priority": 0, "Type": "NONE"}]}}}
What will happen when a request URI contains the text "BadBot"?

medium

A. The rule will cause an error and not apply

B. The request will be blocked by AWS WAF

C. The request will be logged but allowed

D. The request will be allowed without filtering

Solution

1. Step 1: Analyze the ByteMatchStatement

   The rule looks for the string "BadBot" in the URI path and blocks the request if found.

2. Step 2: Understand the action on match

   The action is "Block", so any request matching the condition will be blocked.

3. Final Answer:

   The request will be blocked by AWS WAF -> Option B

4. Quick Check:

   Match "BadBot" in URI = block request [OK]

Hint: ByteMatch with Block action blocks matching requests [OK]

Common Mistakes:

• Assuming requests are allowed by default
• Confusing Block with Count or Allow actions
• Thinking the rule causes errors

4. You created an AWS WAF rule to block requests from IP 203.0.113.5, but requests from this IP are still allowed. What is the most likely cause?

medium

A. The Web ACL is not associated with the resource

B. AWS WAF does not support blocking IP addresses

C. The IP address was not added to the IP set used by the rule

D. The rule action is set to Allow instead of Block

Solution

1. Step 1: Check IP set and rule configuration

   If the IP was not added to the IP set or the rule action was wrong, blocking would fail, but these are common mistakes.

2. Step 2: Verify Web ACL association

   Even if rules are correct, if the Web ACL is not linked to the web resource (like CloudFront or ALB), rules won't apply.

3. Final Answer:

   The Web ACL is not associated with the resource -> Option A

4. Quick Check:

   Web ACL association needed for rules to apply [OK]

Hint: Always associate Web ACL with resource to enforce rules [OK]

Common Mistakes:

• Forgetting to associate Web ACL with the resource
• Assuming AWS WAF can't block IPs
• Setting wrong rule action

5. You want to protect your web app from SQL injection and block requests from a list of suspicious IPs. Which AWS WAF setup is best?

hard

A. Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs

B. Use only an IP set rule to block suspicious IPs, ignoring SQL injection

C. Create a Lambda function to inspect requests and block SQL injection

D. Enable AWS Shield Advanced to block SQL injection and IPs

Solution

1. Step 1: Identify protection needs

   You need to block SQL injection attacks and block suspicious IP addresses.

2. Step 2: Choose AWS WAF features

   AWS WAF provides managed rule groups for SQL injection and supports IP set rules for blocking IPs.

3. Step 3: Evaluate options

   Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs combines managed SQL injection rules and custom IP set blocking, which is best practice. Options B, C, and D do not fully meet requirements or use incorrect services.

4. Final Answer:

   Create a Web ACL with a managed SQL injection rule group and a custom IP set rule to block suspicious IPs -> Option A

5. Quick Check:

   Managed rules + IP sets = full protection [OK]

Hint: Combine managed rules with IP sets for layered protection [OK]

Common Mistakes:

• Using only IP blocking without SQL injection rules
• Relying on Lambda or Shield for WAF tasks
• Not combining rules in one Web ACL