Simultaneously, we must be able to disable or reconfigure some of the rules in the case that they cause undesirable behavior in the application.Ī good first rule group to use is the core rule set (CRS) managed rule group, also named AWSManagedRulesCommonRuleSet.

Instead of writing our own firewall rules to inspect and filter requests, we want to leverage an AWS Managed Rules rule group. Given that you have an existing web application defined in AWS CDK, we want to add a WAFv2 web ACL to its entrypoint. AWS WAFv2 can protect endpoints built by Amazon CloudFront, Amazon API Gateway, Application Load Balancer and AWS AppSync AWS services terminate the TCP/TLS connection, process incoming HTTP requests, and then pass the request to AWS WAF for inspection and filtering.įigure 1.

It can be natively enabled on CloudFront, API Gateway, Application Load Balancer, or AWS AppSync and is deployed alongside these services. No tedious setup required! What is AWS WAFv2?ĪWS WAFv2 is a managed web application firewall. Although it’s usually complex to write your own firewall rules, we can simply use AWS Managed Rules. In this post, you’ll learn how you can easily add a layer of protection to your web application that is defined in AWS Cloud Development Kit (AWS CDK) and built using Amazon CloudFront, Amazon API Gateway, Application Load Balancer, or AWS AppSync. As we evolve the infrastructure that our application is built upon, we can adjust firewall rules in the same place. When we use infrastructure as code (IaC) we want to describe workloads wholistically, and that includes the configuration of firewalls alongside the entrypoints to web applications.

Security is a shared responsibility between AWS and the customer. Post Syndicated from Ramon Lopez Narvaez original

Wafv2