You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -68,142 +68,83 @@ If you have completed **Module 3: Input validation on API Gateway**, your API no
68
68
69
69
</details>
70
70
71
-
### Module 6A: Create a WAF ACL
71
+
### Module 6A: Describe a Web ACL
72
72
73
73
Now let's start creating an AWS WAF to give us additional protection:
74
74
75
75
1. Go to the [AWS WAF Console](https://console.aws.amazon.com/wafv2/home#/wafhome)
76
76
77
-
1. The AWS WAF console has recently released a new version: see [Introducing AWS Managed Rules for AWS WAF
78
-
](https://aws.amazon.com/about-aws/whats-new/2019/11/introducing-aws-managed-rules-for-aws-waf/). However, this workshop has not been yet adapted to the new version. Therefore, we will be using the classic version of the WAF console. You can use the **Switch to AWS WAF Classic** button to switch to classic:
79
77
80
-
81
-
82
-
1. Click on **Create web ACL** on the WAF Classic console
78
+
1. Click on **Create web ACL**
83
79
80
+
84
81
85
82
86
83
1. In Step 1 of the ACL creation wizard, fill in:
87
84
88
85
* **Web ACL Name**: `ProtectUnicorn`
89
86
* **CloudWatch metric name**: this should be automatically populated for you
90
87
* **Region**: select the AWS region you chose for previous steps of the workshop
91
-
* **Resource type to associate with web ACL**: Pick `API Gateway`
92
-
* **Amazon API Gateway API**: Pick the API Gateway we deployed previously, `CustomizeUnicorns`
93
-
* **Stage**: select `dev`
94
-
95
-
96
-
97
-
and click **Next**
98
88
99
-
### Module 6B: Create WAF conditions
89
+
1. To associate the WAF with your API Gateway resources, click **add AWS resources** and select the API Gateway we deployed previously, `CustomizeUnicorns`
90
+
91
+
click **Add**
92
+
93
+
and then **Next**
100
94
101
-
1. Next you will create 2 different conditions. Let's start with a condition to restrict the maximum size of request body:
102
95
103
-
* Go to **Size constraint conditions** section, click **Create condition**
104
-
* Give the condition a name, like `LargeBodyMatch`
105
-
* In Filter settings, add a filer on
106
-
* **Part of the request to filter on**: body
107
-
* **Comparison operator**: Greater than
108
-
* **Size (Bytes)**: 3000
109
-
* Click **Add filter**
110
-
* After the filter is added to the condition, click **Create**
96
+
### Module 6B: Add web ACL rules
111
97
112
-
113
-
98
+
1. Next you will create 3 different rules. Let's start with a rule to restrict the maximum size of request body:
114
99
115
-
1. Next, let's add a SQL injection condition.
116
-
117
-
* Go to **SQL injection match conditions** section, click **Create condition**
118
-
* Give the condition a name, like `SQLinjectionMatch`
119
-
* Here, we want to add multiple rules to inspect multiple aspects of the request: request body, request URI and query strings
120
-
* In the **Filter settings**, add 4 filters:
121
-
122
-
<table>
123
-
<tr>
124
-
<th></th>
125
-
<th>Part of the request to filter on</th>
126
-
<th>Transformation</th>
127
-
</tr>
128
-
<tr>
129
-
<td>1</td>
130
-
<td>Body</td>
131
-
<td>None</td>
132
-
</tr>
133
-
<tr>
134
-
<td>2</td>
135
-
<td>Body</td>
136
-
<td>URL decode</td>
137
-
</tr>
138
-
<tr>
139
-
<td>3</td>
140
-
<td>URI</td>
141
-
<td>URL decode</td>
142
-
</tr>
143
-
<tr>
144
-
<td>4</td>
145
-
<td>Query string</td>
146
-
<td>URL decode</td>
147
-
</tr>
148
-
</table>
149
-
* Click **Create**
100
+
101
+
* **Rule Type** select **Rule Builder**
102
+
* **Rule Name** Give the rulle a name, like `LargeBodyMatch`
103
+
* **Type** Regular rule
104
+
* **If a request** matches the statement
105
+
* **Inspect** Body
106
+
* **Content Type** Plain text
107
+
* **Match type** Size greater than
108
+
* **Size** `3000`
109
+
* **Action** Block
110
+
111
+
* Then click **Add Rule**
150
112
151
-
152
-
153
-
1. Click **Next** to advance to the **Create rules** page
154
-
155
-
156
-
### Module 6C: Create WAF rules
157
113
114
+
1. Next, let's add a SQL injection rule.
158
115
159
-
1. Next, we create **Rules** that are composed of one or more **Conditions**. Let's start by creating a rule based on the request body size condition:
160
-
161
-
* Click **Create Rule**
162
-
* Give it a name, like `LargeBodyMatchRule`
163
-
* For **Rule type**, keep `Regular rule`
164
-
* In Add conditions section, select
165
-
* `does`
166
-
* `match at least one of the filters in the size constraint condition `
167
-
* `LargeBodyMatch` -- the name of the condition we created for large request body in 6B
168
-
169
-
* Then click **Create**
116
+
117
+
* Expand the **AWS managed rule groups** section
118
+
* toggle the **SQL database** option
119
+
120
+
* Then click **Add Rule**
170
121
171
-
172
-
173
-
1. Next, we create the rule for SQL injection.
174
-
175
-
* Click **Create Rule**
176
-
* Give it a name, like `SQLinjectionRule`
177
-
* For **Rule type**, keep `Regular rule`
178
-
* In Add conditions section, select
179
-
* `does`
180
-
* `match at least one of the filters in the SQL injection match condition `
181
-
* `SQlInjectionMatch` -- the name of the condition we created for SQL injection in 6B
182
-
* Then click **Create**
183
-
184
-
185
122
186
123
1. Lastly, we can create a rate-based rule that prevents an overwhelming number of requests (either valid or invalid) from flooding our API:
187
124
188
-
* Click **Create Rule**
189
-
* Give it a name, like `RequestFloodRule`
125
+
126
+
* Give it a **Name**, like `RequestFloodRule`
190
127
* For **Rule type**, select `Rate-based rule`
191
128
* For **Rate limit**, use `2000`
129
+
* **IP address to use for rate limiting** Source IP address
130
+
* **Criteria to count request towards rate limit** Consider all requests
131
+
* **Action** Block
192
132
* Then click **Create**
193
133
194
-
134
+
195
135
196
136
1. You should now see 3 rules in like below. Ensure you select `Block` if the request matches any of the rules.
197
137
198
138
For **Default action**, select `Allow all requests that don't match any rules`
199
139
200
-
201
-
202
-
1. Click **Review and create**
140
+
141
+
### Modules 6C: Rule priorities, metrics and review
142
+
1. Frome here you can use the default selected options,
143
+
144
+
203
145
204
-
1. In the next page, review the configuration and click **Confirm and Create**
205
-
206
-
146
+
147
+
1. and now you can **Create Web ACL**
207
148
208
149
You have now added a WAF to our API gateway stage!
0 commit comments