​
Event Information

  • The DeleteWebACL event in AWS for WAF refers to the action of deleting a Web Application Firewall (WAF) Access Control List (ACL).
  • When this event occurs, it means that the specified WebACL, which contains rules to filter and allow or deny incoming web requests, has been removed from the AWS account.
  • This event can be triggered manually by an administrator or through an automated process, and it signifies the removal of the WAF protection for the associated resources.

​
Examples

  1. Unauthorized deletion: If security is impacted with DeleteWebACL in AWS WAF, one example could be an unauthorized user gaining access to the AWS Management Console or API credentials and deleting a WebACL. This could result in the removal of important security rules and configurations, leaving the application vulnerable to attacks.
  2. Misconfiguration: Another example could be a misconfiguration in the access control policies or permissions associated with the DeleteWebACL action. If the permissions are not properly set, it could allow unintended users or roles to delete WebACLs, leading to potential security breaches.
  3. Malicious intent: A third example could be a malicious insider or an attacker compromising the AWS account and intentionally deleting WebACLs. This could be part of a larger attack strategy to disrupt the application’s security measures and gain unauthorized access to sensitive data or resources.

​
Remediation

​
Using Console

  1. Identify the specific AWS WAF rule that needs to be remediated based on the examples provided.
    • Log in to the AWS Management Console and navigate to the AWS WAF service.
    • Select the appropriate web ACL that contains the rule that needs to be remediated.
  2. Modify the AWS WAF rule to address the identified issue.
    • Within the selected web ACL, locate the rule that needs to be remediated.
    • Click on the rule to access its configuration settings.
    • Adjust the rule’s parameters or conditions to align with the desired remediation action.
    • Save the changes made to the rule.
  3. Test and monitor the remediated AWS WAF rule.
    • Deploy the updated web ACL to the appropriate AWS resources (e.g., Amazon CloudFront distribution, Application Load Balancer).
    • Monitor the traffic and behavior of the protected resources to ensure that the remediated rule is functioning as expected.
    • Continuously monitor and analyze the AWS WAF logs and metrics to identify any potential issues or anomalies that may require further remediation.
Note: The specific steps may vary depending on the AWS WAF console interface and the nature of the rule being remediated. It is important to refer to the AWS documentation for detailed instructions and best practices.

​
Using CLI

  1. To remediate a specific rule in AWS WAF using AWS CLI, you can use the update-rule command. For example, if you want to update a rule with the rule ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:
aws wafv2 update-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --action ALLOW
This command updates the action of the rule to ALLOW. You can replace ALLOW with BLOCK, COUNT, or NONE depending on your requirement.
  1. To remediate a rate-based rule in AWS WAF using AWS CLI, you can use the update-rate-based-rule command. For example, if you want to update a rate-based rule with the rule ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:
aws wafv2 update-rate-based-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --rate-key IP --rate-limit 100
This command updates the rate limit of the rule to 100 requests per 5 minutes. You can adjust the rate-limit parameter as per your requirement.
  1. To remediate a managed rule group in AWS WAF using AWS CLI, you can use the update-web-acl command. For example, if you want to update a managed rule group with the ARN arn:aws:wafv2:us-west-2:123456789012:regional/webacl/MyWebACL/managed-rule-group/SQLi-ManagedRuleSet in a WebACL named MyWebACL, you can use the following command:
aws wafv2 update-web-acl --name MyWebACL --scope REGIONAL --default-action ALLOW --rules-action ALLOW --rules 'managedRuleGroupStatement={vendorName=AWS, name=SQLi-ManagedRuleSet, excludedRules=[]}'
This command updates the default action and rules action of the WebACL to ALLOW and updates the managed rule group to SQLi-ManagedRuleSet. You can modify the parameters based on your specific requirements.

​
Using Python

  1. Example 1: Blocking IP addresses with AWS WAF using Python
To remediate this issue, you can use the AWS SDK for Python (Boto3) to automate the process of blocking IP addresses in AWS WAF. Here’s a Python script that demonstrates how to achieve this: 
import boto3

def block_ip_address(ip_address):
    waf_client = boto3.client('waf')

    response = waf_client.update_ip_set(
        IPSetId='your_ip_set_id',
        ChangeToken='your_change_token',
        Updates=[
            {
                'Action': 'INSERT',
                'IPSetDescriptor': {
                    'Type': 'IPV4',
                    'Value': ip_address
                }
            }
        ]
    )

    print(f"IP address {ip_address} has been blocked successfully.")

# Usage example
block_ip_address('192.168.0.1')
  1. Example 2: Creating a rate-based rule with AWS WAF using Python
To remediate this issue, you can use the AWS SDK for Python (Boto3) to automate the process of creating a rate-based rule in AWS WAF. Here’s a Python script that demonstrates how to achieve this: 
import boto3

def create_rate_based_rule(rule_name, metric_name, rate_limit):
    waf_client = boto3.client('waf')

    response = waf_client.create_rate_based_rule(
        Name=rule_name,
        MetricName=metric_name,
        RateLimit=rate_limit,
        ChangeToken='your_change_token'
    )

    print(f"Rate-based rule {rule_name} has been created successfully.")

# Usage example
create_rate_based_rule('MyRateBasedRule', 'MyMetric', 1000)
  1. Example 3: Updating a rule group with AWS WAF using Python
To remediate this issue, you can use the AWS SDK for Python (Boto3) to automate the process of updating a rule group in AWS WAF. Here’s a Python script that demonstrates how to achieve this: 
import boto3

def update_rule_group(rule_group_id, updates):
    waf_client = boto3.client('waf')

    response = waf_client.update_rule_group(
        RuleGroupId=rule_group_id,
        Updates=updates,
        ChangeToken='your_change_token'
    )

    print(f"Rule group {rule_group_id} has been updated successfully.")

# Usage example
updates = [
    {
        'Action': 'INSERT',
        'ActivatedRule': {
            'Priority': 1,
            'RuleId': 'your_rule_id'
        }
    }
]
update_rule_group('your_rule_group_id', updates)
Please note that you need to replace the placeholder values (e.g., your_ip_set_id, your_change_token, etc.) with the actual values specific to your AWS environment.