AWS WAF(Web Application Firewall)

Tanya Garg

21 April 2022

We are witnessing remarkable technology developments that are transforming the way the world functions in only a few years.

Websites, online apps, and servers, which are important components of today’s organizations, therefore, are high on the hit list of cyber-attackers looking for new and inventive ways to launch attacks.

As a result, web app security measures and tactics are in high demand to counter these threats, and a Web Application Firewall (WAF) has become an integral part in order to defend critical assets of an organization.

What is a Web Application Firewall?

A web application firewall (WAF) secures your web apps by filtering, monitoring, and as well as blocking threatening requests.

As you may know, this is the app’s first line of defense against internet traffic.

Generally, attackers use proxy to anonymize their identity, in the same way, a WAF protects the web app server details from a potentially dangerous client by acting as a reverse proxy.

A WAF is controlled by a set of rules known as policies. WAF can act more powerful with custom rules according to the organization’s needs.

What is AWS WAF?

AWS WAF is a web application firewall that helps protect web applications from threats by allowing you to set up rules that allow, reject, or count web requests based on parameters you specify.

IP addresses, HTTP headers, HTTP body, URI strings, SQL injection, and cross-site scripting are among the conditions, You can either utilize AWS’s default security rules or create your own.

In order to provide you with more flexibility, these rules can be enforced on a per-application basis.

When the associated service receives requests for your websites, it sends them to AWS WAF to be inspected for compliance with your rules.

When a request fulfills one of your rules’ conditions, AWS WAF advises the underlying service to block or accept the request, depending on the action you specify.

Types of Rule Groups

There are basically 3 types of Rules Groups –

Managed Rule Group

Managed rule groups are created and maintained for you by AWS Managed Rules and AWS Marketplace merchants.

Own Rule Group

These are those rules which are created and maintained by the user only.

Mixed Rules

AWS Firewall Manager and Shield Advanced have their own rule groups that they own and control.

How these rules work

We use AWS WAF rules on the basis of certain criteria like –

Malicious scripts are embedded in online applications by attackers to exploit security flaws (known as Cross-site scripting (XSS)).
SQL code with a high probability of being malicious. By injecting these malicious SQL codes into a web request, attackers attempt to steal data from your database. (Known as SQL injection).
Requests originated from which IP addresses.
Requests coming from which geographical locations.
Length of specified query strings.
We can further use regular expressions to specify strings that appear in the request.
In addition, AWS WAF allows you to combine statements in a rule using logical statements for AND, OR, and NOT.

Benefits of using AWS WAF

AWS WAF provides near-real-time visibility into your web traffic, which you may use to develop new Amazon CloudWatch rules or alerts.
You can rapidly get started and secure your web application or APIs against typical risks with Managed Rules for AWS WAF.
Managed rules are updated automatically as new issues arise, therefore, allowing you to spend more time developing applications.
WAF supports hundreds of rules, which may check any element of a web request with minimal latency impact on incoming traffic.
You can centrally define and maintain your rules with AWS Firewall Manager integration, and reuse them across all the web apps you need to secure.
Bot(such as search crawlers) Control-managed rule groups are available through AWS WAF and can be used in combination with other rules to secure your apps. This is a useful feature, but it is not free.
In addition, AWS WAF makes it simple to set up and safeguard applications that are hosted on Amazon CloudFront as part of your CDN solution, the Application Load Balancer, Amazon API Gateway for REST APIs, or AWS AppSync for GraphQL APIs.

Limitations

Security Expertise

AWS WAF has the capacity to identify malicious attempts and deal with them individually, but using it effectively requires highly specialized abilities.

As a result, consumers may have to learn about vulnerabilities and prepare for them.

Limited Security

AWS WAF isn’t intended to be a comprehensive security platform. However, It is not designed to defend against a wide range of threats.

Even when it comes to the risks it does address, the security it provides is often inadequate.

How does AWS WAF work?

AWS WAF is a web application firewall that allows you to monitor HTTP and HTTPS requests forwarded to an Amazon CloudFront distribution, and Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API.

You can also forbid access to your application using either source IP or geolocation with AWS WAF.

Amazon CloudFront, Amazon API Gateway, Application Load Balancer, or AWS AppSync responds to requests with the requested content or with an HTTP 403 status code(Forbidden) based on conditions you define, such as the IP addresses from which requests originate or the values of query strings.

When a request is blocked, you can also configure CloudFront to return a custom error page.

AWS WAF Pricing

You’ll pay for each web ACL you build, as well as each rule you add to each web ACL.
You will also pay for the number of web requests that the web ACL processes.
All AWS Regions have the same pricing.
So, monthly costs will be calculated on an hourly basis
And, you will also pay for rules that you establish within rule groups.
In addition, each rule group or managed rule group that you add to your web ACL will be charged $1.00 per month (prorated hourly).

The prices for AWS WAF are the same as in the table below –

Resource Type	Price
Web ACL	$5.00 per month(prorated hourly)
Rule	$1.00 per month(prorated hourly)
Request	$0.60 per 1 million Requests

For further details, refer to this AWS WAF Pricing.

Another well Known WAF provider

Cloudflare WAF

The Cloudflare web application firewall (WAF) is the keystone of our advanced application security portfolio, protecting apps and APIs from DDoS assaults, bots, abnormalities, and malicious payloads while also monitoring for browser supply chain attacks.

Key Features –

Layered protection from multiple WAF rulesets
WAF Machine learning-based detections
Updated rules for zero-day protection
Data loss prevention
Exposed Credential Checks
SSL/TLS
DDoS Mitigation

For further details, please refer to Cloudflare WAF.

Conclusion

WAFs are a specific form of Level 7 firewall that can inspect web traffic. Websites, web apps, and API services are all protected by WAFs.

Cloud-based WAFs are platform-independent, simple to set up, as well as scalable. WAFs can monitor, analyze traffic in real-time, and notify administrators of any potential threats within no time.

In our next log, we will be discussing another security managed service of AWS i.e, AWS Shield for protection against DDoS Attacks.

Need Support?

Thank You for reading this Blog!

For further more interesting blogs, keep in touch with us. If you need any kind of support, simply raise a ticket at https://webkul.uvdesk.com/en/.