WebACL Rules Should Not Be In Count Mode

Using Console

Using CLI

WebACL rules should not be in count mode because this mode only counts the web requests that match the properties of a rule, but does not block or allow them. Here are the steps to remediate this misconfiguration using AWS CLI:Step 1: Install AWS CLI Firstly, you need to install AWS CLI on your system. You can download it from the official AWS website.Step 2: Configure AWS CLI Once installed, you need to configure AWS CLI with your AWS account details. You can do this by running the following command in your terminal:

aws configure

You’ll be prompted to enter your AWS Access Key ID, Secret Access Key, default region name, and default output format. Enter these details correctly.Step 3: List WebACLs Next, you need to list all the WebACLs in your account. You can use the following command:

aws wafv2 list-web-acls --scope REGIONAL

This will list all the WebACLs in your account.Step 4: Identify WebACLs in Count Mode Go through the list of WebACLs and identify the ones that are in count mode. You can do this by checking the “DefaultAction” field of each WebACL. If it is set to “COUNT”, the WebACL is in count mode.Step 5: Change DefaultAction to Block or Allow Once you’ve identified the WebACLs in count mode, you need to change their DefaultAction to either “BLOCK” or “ALLOW”. You can use the following co the DefaultAction of the WebACL to “ALLOW”. If you want to change it to “BLOCK”, replace Allow= with Block=. mmand:

aws wafv2 update-web-acl --name <name> --scope REGIONAL --id <id> --default-action Allow={} --lock-token lock-token

Replace name with the name of the WebACL, id with the ID of the WebACL, and lock-token with the lock token of the WebACL. This command will change Step 6: Verify the Changes Finally, verify the changes by listing the WebACLs again and checking their DefaultAction. If it is set to “BLOCK” or “ALLOW”, the remediation was successful.Remember to replace all the placeholders with actual values. Also, ensßure that you have the necessary permissions to perform these actions.

Using Python

The WebACL rules in count mode essentially means that the rule is only counting the matches for a rule without any action. This configuration can be useful for testing, but in a production environment, it’s recommended to change it to block or allow mode.Here’s how to remediate this misconfiguration using AWS SDK for Python (Boto3):

First, install Boto3 if it’s not already installed. You can do this by running the following command in your terminal:
```
pip install boto3
```

Import the necessary modules and set up your AWS credentials:

import boto3
from botocore.exceptions import NoCredentialsError

ACCESS_KEY = 'YOUR_ACCESS_KEY'
SECRET_KEY = 'YOUR_SECRET_KEY'

Create a session using your credentials:

session = boto3.Session(
    aws_access_key_id=ACCESS_KEY,
    aws_secret_access_key=SECRET_KEY
)

Now, use the session to create a client for AWS WAF (Web Application Firewall):
```
client = session.client('waf')
```

Get the list of WebACLs:

webacls = client.list_web_acls(Limit=100)

Iterate over the WebACLs and check if any rules are in count mode:

for webacl in webacls['WebACLs']:
    webacl_id = webacl['WebACLId']
    webacl_rules = client.get_web_acl(WebACLId=webacl_id)['WebACL']['Rules']

    for rule in webacl_rules:
        if rule['Type'] == 'REGULAR' and rule['Action']['Type'] == 'COUNT':
            print(f"WebACL {webacl_id} has a rule in count mode")

To change the rules from count mode to block mode, you need to update the rule:

for webacl in webacls['WebACLs']:
    webacl_id = webacl['WebACLId']
    webacl_rules = client.get_web_acl(WebACLId=webacl_id)['WebACL']['Rules']

    for rule in webacl_rules:
        if rule['Type'] == 'REGULAR' and rule['Action']['Type'] == 'COUNT':
            rule_id = rule['RuleId']
            client.update_rule(Action='BLOCK', RuleId=rule_id)

Please note that you need to replace ‘YOUR_ACCESS_KEY’ and ‘YOUR_SECRET_KEY’ with your actual AWS access key and secret key. Also, make sure that the user associated with the keys has the necessary permissions to list and update WebACLs.Remember to handle exceptions and errors appropriately in your production code.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

WebACL Rules Should Not Be In Count Mode

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation