Security / AWS / Tech

Understanding AWS WAFv2 to Fortify your Web Applications

Lewis Shobbrook Lewis Shobbrook

5 Minute Read

In today's online infrastructure, web application security is paramount. Reputations that take years to build, can be wiped out overnight at the hands of bad actors penetrating vulnerabilities within your application. WAFv2, the updated version of Amazon Web Services' Web Application Firewall, provides advanced security features designed to protect your web applications from web exploits and vulnerabilities.

In this blog post, we discuss the key advantages and components of WAFv2, and help explain why it's such a vital tool for safeguarding online assets.

How we roll at base2Services

We are all about Infrastructure as Code (IAC) at base2Services. When implementing AWS WAFv2, we use AWS CloudFormation templates to describe each component of the Access Control List (ACL). Enhancements are added over time, or in response to emerging threats. The WAF changes progress from non-production environments, then following validation and testing, are promoted to production environments. This process eliminates human errors in deployment, that erode success and confidence.

We do not believe in one-size-fits-all security. With WAFv2, we craft bespoke protection that is tailored to your specific needs. We block or allow access to a service network dynamically, through the use of AWS Lambda. AWS Lambda offers a powerful way to automate the management of IP sets, allowing us to dynamically adjust IP addresses in response to evolving security needs or traffic patterns. This approach not only reduces manual work, but also ensures that your security policies remain agile and responsive to real-time changes. Whether it's managing reputational lists or thwarting application scanners, we've got you covered.

Advantages of using AWS WAFv2

1. Enhanced Security Features

    1. Customisable Rules:

      WAFv2 allows you to create custom rules that can be tailored to your specific security needs. Rules are defined based on IP addresses, HTTP headers, HTTP body, URI strings, and more.

      Often, use cases require a dynamic approach. If a particular service network you wish to block or allow access to is in a state of flux, manually managing the IP set (a collection of IP addresses or ranges) can become tedious or create bigger problems if left unattended and unmaintained.

      In such cases, base2 often uses AWS Lambda to update an IP set based on rules and schedules specific to the use case. This could include a reputational list, a publicised regional network service range, or application scanners and probers from the web that can be automatically detected via application logs.

    2. Managed Rules:

      WAFv2 offers sets of pre-configured rules. These rules provide protection against common threats like SQL injection, cross-site scripting (XSS), known bad inputs and other OWASP top threats.

2. Improved Management and Monitoring

    1. Unified Management Console:

      The updated management console provides a more intuitive interface, making it easier to set up and manage your web application firewall.

    2. Real-time Visibility:

      WAFv2 offers real-time visibility into web traffic, enabling you to monitor, analyse, and act on potential threats quickly.

    3. Extended monitoring via S3 or CloudWatch:

      Often specific URI data is required to react dynamically to threats or detailed logging and monitoring of web requests. This integration helps in analysing traffic patterns and identifying potential security threats.

    4. Sampled Requests:

      WAFv2 provides sampled requests for further inspection, allowing you to analyse a subset of requests that match your rules.

3. Cost Efficiency

    1. Pay-as-You-Go Pricing:

      WAFv2 operates on a pay-as-you-go pricing model, ensuring you only pay for what you use. This model makes it cost-effective, especially for small to medium-sized businesses (SMEs).

4. Scalability and Flexibility

    1. Integration with AWS Services:

      WAFv2 seamlessly integrates with other AWS services such as Amazon CloudFront, Amazon API Gateway, Amazon Cognito user pool and more importantly Application Load Balancers.

    2. Scalable Infrastructure:

      Designed to handle varying levels of web traffic, WAFv2 scales with your applications, ensuring consistent performance and security.

The Important Components of AWS WAFv2

Here, I've listed the key components of AWS WAFv2. By breaking down the essential elements, it's easier to see how each part contributes to a more secure,  more adaptable and more personalised web application firewall. 

1. Web ACLs (Web Access Control Lists)

    1. Definition:

      A Web ACL is a set of rules that define the conditions under which web requests are allowed or blocked.

    2. Functionality:
      Web ACLs are used to manage and organise rules. You can associate multiple rules with a Web ACL to enforce comprehensive security policies on your web applications.

2. Rules and Rule Groups

    1. Custom Rules:

      These are user-defined rules that specify conditions to inspect web requests.

    2. Managed Rule Groups:

      AWS provides pre-configured rule groups maintained by AWS or AWS Marketplace sellers. These rules are continuously updated to protect against emerging threats.

3. Conditions

    1. IP Match Conditions:

      Specify IP addresses or ranges to allow or block traffic from specific sources.

    2. String Match Conditions:

      Define patterns to search for within web requests, such as specific headers or URI strings.

    3. Regex Match Conditions:

      Use regular expressions to create complex search patterns for inspecting web requests.

4. Rate-Based Rules

    1. Functionality:

      Rate-based rules help you manage traffic spikes and potential DDoS attacks by limiting the number of requests from a single IP address within a specified time period.

      If a single IP exceeds a nominal limit, they can be blocked from access for a window of time, or presented with a challenge in the form of CAPTCHA.

    2. Automated Mitigation:

      When coupled with AWS Shield Advanced, you can achieve automatic detection and mitigation of DDoS attacks, including creation and triggering of WAF rules to block malicious traffic in real-time.

Logging and Monitoring

    1. AWS CloudWatch Integration:

      WAFv2 integrates with AWS CloudWatch, providing detailed logging and monitoring of web requests. This integration helps in analysing traffic patterns and identifying potential security threats.

    2. Sampled Requests:

      WAFv2 provides sampled requests for further inspection, allowing you to analyse a subset of requests that match your rules.

AWS WAFv2 offers a powerful, flexible, and cost-effective solution for protecting your web applications from many existing web threats, as well as capacity for elegant bespoke automated solutions. Its enhanced security features, improved management tools, and seamless integration with other AWS services make it an essential component of any AWS associated cloud security strategy.

By leveraging WAFv2, businesses can provide advanced automated security and resilience against evolving cyber threats for their web applications.

We combine the power of AWS WAFv2 with our deep expertise to create security solutions that don't just protect your web applications – they empower your business to thrive in the digital world. Reach out to find out how we can secure your online presence.

Related Blog Posts


More Blog Posts