> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Waf acl basic rules protection remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here are the step-by-step instructions on how to remediate this misconfiguration:

        1. Sign in to the AWS Management Console and open the AWS WAF console at [https://console.aws.amazon.com/wafv2/](https://console.aws.amazon.com/wafv2/).

        2. In the navigation pane, choose "WebACLs".

        3. Choose the WebACL that you want to add a rule to.

        4. In the Rules section, choose "Add rules".

        5. In the Add rule window, choose "Create rule".

        6. In the Rule builder section, for Name, type a name for your rule.

        7. For If a request, choose "Matches the statement".

        8. For Statement, choose the type of statement that you want to use. For this scenario, you can choose "IP address" and specify the IP addresses that you want to allow or block.

        9. For Action, choose "Block" to block requests that match the statement, or "Allow" to allow requests that match the statement.

        10. Choose "Add to WebACL" to add the rule to your WebACL.

        11. After you've added all the rules that you want, choose "Create".

        12. In the WebACL, for Default action, choose "Block" to block all requests that don't match any rules, or "Allow" to allow all requests that don't match any rules.

        13. Choose "Save" to save your changes.

        Remember to test your new rules with non-production traffic. After you're confident that your rules are working as expected, you can apply them to your production traffic.
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this misconfiguration, you need to add a new rule to your AWS WAF WebACL. Here are the steps to do this using the AWS CLI:

        1. **Identify your WebACL:** First, you need to identify the WebACL that you want to update. You can do this by running the following command:

           ```
           aws waf list-web-acls --scope REGIONAL
           ```

           This will return a list of all your WebACLs. Note down the ID of the WebACL you want to update.

        2. **Create a WAF rule:** Next, you need to create a new WAF rule that provides the basic protection you want. For example, you might want to create a rule that blocks IP addresses that are known to be sources of DDoS attacks. Here's how you can do this:

           ```
           aws waf create-rule --name "BlockBadIPs" --metric-name "BlockBadIPs" --change-token $(aws waf get-change-token --query 'ChangeToken' --output text) --region us-west-2
           ```

           This command creates a new rule named "BlockBadIPs". The `--change-token` parameter is required for all WAF operations that change the service. The `get-change-token` command retrieves a change token that you can use in your command. Replace `--region` with your region.

        3. **Add the rule to your WebACL:** Once you have created the rule, you can add it to your WebACL with the following command:

           ```
           aws waf update-web-acl --web-acl-id <Your-WebACL-ID> --change-token $(aws waf get-change-token --query 'ChangeToken' --output text) --updates Action="INSERT" ActivatedRule={Priority=0,RuleId="<Your-Rule-ID>",Action={Type="BLOCK"}} --region us-west-2
           ```

           Replace `<Your-WebACL-ID>` with the ID of your WebACL and `<Your-Rule-ID>` with the ID of the rule you just created. Again, replace `--region` with your region.

        4. **Verify the change:** Finally, you can verify that the rule has been added to your WebACL by running the following command:

           ```
           aws waf get-web-acl --web-acl-id <Your-WebACL-ID> --region us-west-2
           ```

           This will return the details of your WebACL, including the rules that it contains. You should see the rule you just added in the list.

        Remember to replace all placeholders with your actual IDs and region.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this misconfiguration, you need to create a basic rule for AWS WAF (Web Application Firewall) WebACLs (Access Control Lists). This can be done using the AWS SDK for Python (Boto3). Here are the step-by-step instructions:

        1. **Install AWS SDK for Python (Boto3)**: If you haven't installed Boto3, you can install it using pip:
           ```
           pip install boto3
           ```

        2. **Configure AWS Credentials**: You need to configure your AWS credentials. You can configure them by using the AWS CLI (Command Line Interface):
           ```
           aws configure
           ```
           You will be prompted to provide your AWS Access Key ID and Secret Access Key, which you can get from your AWS Management Console.

        3. **Create a Basic Rule**: Now, you can create a basic rule for your WebACL using Boto3. Here is a basic example:

           ```python theme={null}
           import boto3

           client = boto3.client('waf')

           response = client.create_rule(
               Name='BasicRule',
               MetricName='BasicRule',
               ChangeToken='string',
               Predicates=[
                   {
                       'Negated': False,
                       'Type': 'IPMatch',
                       'DataId': 'string'
                   },
               ]
           )
           ```

           In this example, we are creating a rule that blocks requests from specific IP addresses. You need to replace `'string'` in `ChangeToken` and `DataId` with your own values. `ChangeToken` is a value returned by a previous call to get a change token, and `DataId` is the ID of the IPSet that you want to use in the rule.

        4. **Add the Rule to a WebACL**: After creating the rule, you need to add it to a WebACL. Here is how you can do it:

           ```python theme={null}
           response = client.update_web_acl(
               WebACLId='string',
               ChangeToken='string',
               Updates=[
                   {
                       'Action': 'INSERT',
                       'ActivatedRule': {
                           'Priority': 123,
                           'RuleId': 'string',
                           'Action': {
                               'Type': 'BLOCK'
                           },
                       }
                   },
               ],
               DefaultAction={
                   'Type': 'ALLOW'
               }
           )
           ```

           In this example, you need to replace `'string'` in `WebACLId`, `ChangeToken`, and `RuleId` with your own values. `WebACLId` is the ID of the WebACL that you want to update, `ChangeToken` is the same as before, and `RuleId` is the ID of the rule that you created before.

        Please note that these are basic examples. Depending on your specific needs, you may need to customize these scripts. Always refer to the official AWS Boto3 documentation for more detailed information.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_wafv2_web_acl" "this" {
          name  = "WEB_ACL_NAME"     # replace with your Web ACL name
          scope = "REGIONAL"         # or "CLOUDFRONT"

          default_action {
            allow {}
          }

          visibility_config {
            sampled_requests_enabled   = true
            cloudwatch_metrics_enabled = true
            metric_name                = "WEB_ACL_METRIC_NAME" # replace with desired CloudWatch metric name
          }

          # 1. AWS Managed IP reputation list
          rule {
            name     = "AWS-Managed-Rule-IP-Reputation-List"
            priority = 10

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesAmazonIpReputationList"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-IP-Reputation-List"
            }
          }

          # 2. AWS Managed Anonymous IP list
          rule {
            name     = "AWS-Managed-Rule-Anonymous-IP-List"
            priority = 20

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesAnonymousIpList"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-Anonymous-IP-List"
            }
          }

          # 3. AWS Managed core ruleset (Common Rule Set)
          rule {
            name     = "AWS-Managed-Rule-Core-Set"
            priority = 30

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesCommonRuleSet"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-Core-Set"
            }
          }

          # 4. AWS Managed Known Bad Input List
          rule {
            name     = "AWS-Managed-Rule-Known-Bad-Inputs"
            priority = 40

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesKnownBadInputsRuleSet"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-Known-Bad-Inputs"
            }
          }

          # 5. AWS Managed SQLI Ruleset
          rule {
            name     = "AWS-Managed-Rule-SQLi"
            priority = 50

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesSQLiRuleSet"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-SQLi"
            }
          }

          # 6. AWS Managed Linux Ruleset
          rule {
            name     = "AWS-Managed-Rule-Linux"
            priority = 60

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesLinuxRuleSet"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-Linux"
            }
          }

          # 7. AWS Managed Admin Protection Ruleset
          rule {
            name     = "AWS-Managed-Rule-Admin-Protection"
            priority = 70

            statement {
              managed_rule_group_statement {
                vendor_name = "AWS"
                name        = "AWSManagedRulesAdminProtectionRuleSet"
              }
            }

            override_action {
              none {}
            }

            visibility_config {
              sampled_requests_enabled   = true
              cloudwatch_metrics_enabled = true
              metric_name                = "AWS-Managed-Rule-Admin-Protection"
            }
          }
        }
        ```

        This Terraform configuration mirrors the `update-web-acl` behavior by fully managing the `rules` array on the `aws_wafv2_web_acl`, adding the required AWS Managed Rule Groups with unique priorities and CloudWatch visibility configuration. Updating rules is an in-place change and should not force replacement of the Web ACL, but may affect live traffic when applied.

        For verification, `terraform plan` should show `aws_wafv2_web_acl.this` with `rule` blocks added (or updated) corresponding exactly to these seven managed rule groups, and no destruction/recreation of the Web ACL resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>