WAF WebACLs Must Have Basic Rule Protection
More Info:
Web ACL rule group should have certain defined set of rule groups: AWS Managed IP reputation List AWS Managed Anonymous IP List AWS Managed core ruleset AWS Managed Known Bad Input List AWS Managed SQLI Ruleset AWS Managed Linux Ruleset AWS Managed Admin Protection RulesetRisk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
Here are the step-by-step instructions on how to remediate this misconfiguration:
- Sign in to the AWS Management Console and open the AWS WAF console at https://console.aws.amazon.com/wafv2/.
- In the navigation pane, choose “WebACLs”.
- Choose the WebACL that you want to add a rule to.
- In the Rules section, choose “Add rules”.
- In the Add rule window, choose “Create rule”.
- In the Rule builder section, for Name, type a name for your rule.
- For If a request, choose “Matches the statement”.
- For Statement, choose the type of statement that you want to use. For this scenario, you can choose “IP address” and specify the IP addresses that you want to allow or block.
- For Action, choose “Block” to block requests that match the statement, or “Allow” to allow requests that match the statement.
- Choose “Add to WebACL” to add the rule to your WebACL.
- After you’ve added all the rules that you want, choose “Create”.
- In the WebACL, for Default action, choose “Block” to block all requests that don’t match any rules, or “Allow” to allow all requests that don’t match any rules.
- Choose “Save” to save your changes.
Using CLI
Using CLI
To remediate this misconfiguration, you need to add a new rule to your AWS WAF WebACL. Here are the steps to do this using the AWS CLI:
-
Identify your WebACL: First, you need to identify the WebACL that you want to update. You can do this by running the following command:
This will return a list of all your WebACLs. Note down the ID of the WebACL you want to update.
-
Create a WAF rule: Next, you need to create a new WAF rule that provides the basic protection you want. For example, you might want to create a rule that blocks IP addresses that are known to be sources of DDoS attacks. Here’s how you can do this:
This command creates a new rule named “BlockBadIPs”. The
--change-tokenparameter is required for all WAF operations that change the service. Theget-change-tokencommand retrieves a change token that you can use in your command. Replace--regionwith your region. -
Add the rule to your WebACL: Once you have created the rule, you can add it to your WebACL with the following command:
Replace
<Your-WebACL-ID>with the ID of your WebACL and<Your-Rule-ID>with the ID of the rule you just created. Again, replace--regionwith your region. -
Verify the change: Finally, you can verify that the rule has been added to your WebACL by running the following command:
This will return the details of your WebACL, including the rules that it contains. You should see the rule you just added in the list.
Using Python
Using Python
To remediate this misconfiguration, you need to create a basic rule for AWS WAF (Web Application Firewall) WebACLs (Access Control Lists). This can be done using the AWS SDK for Python (Boto3). Here are the step-by-step instructions:
-
Install AWS SDK for Python (Boto3): If you haven’t installed Boto3, you can install it using pip:
-
Configure AWS Credentials: You need to configure your AWS credentials. You can configure them by using the AWS CLI (Command Line Interface):
You will be prompted to provide your AWS Access Key ID and Secret Access Key, which you can get from your AWS Management Console.
-
Create a Basic Rule: Now, you can create a basic rule for your WebACL using Boto3. Here is a basic example:
In this example, we are creating a rule that blocks requests from specific IP addresses. You need to replace
'string'inChangeTokenandDataIdwith your own values.ChangeTokenis a value returned by a previous call to get a change token, andDataIdis the ID of the IPSet that you want to use in the rule. -
Add the Rule to a WebACL: After creating the rule, you need to add it to a WebACL. Here is how you can do it:
In this example, you need to replace
'string'inWebACLId,ChangeToken, andRuleIdwith your own values.WebACLIdis the ID of the WebACL that you want to update,ChangeTokenis the same as before, andRuleIdis the ID of the rule that you created before.