Network_security
Chapter 28: AWS WAF, Shield & Firewall
Section titled “Chapter 28: AWS WAF, Shield & Firewall”Network Security Services
Section titled “Network Security Services”28.1 Overview
Section titled “28.1 Overview”AWS provides multiple layers of network security to protect your applications from common web exploits and DDoS attacks.
AWS Network Security Overview+------------------------------------------------------------------+| || +------------------------+ || | Network Security | || +------------------------+ || | || +---------------------+---------------------+ || | | | || v v v || +----------+ +----------+ +----------+ || | WAF | | Shield | | Firewall | || | | | | | Manager | || | - Web | | - DDoS | | - Central| || | Attacks| | Protect| | Manage | || | - Rules | | - Shield | | - Rules | || | - Bot | | Advanced| | - Policies| || | Control| | | | | || +----------+ +----------+ +----------+ || |+------------------------------------------------------------------+Service Comparison
Section titled “Service Comparison”| Feature | WAF | Shield Standard | Shield Advanced | Firewall Manager |
|---|---|---|---|---|
| Protection Type | Web exploits | DDoS | DDoS + Support | Central management |
| Cost | Per rule + request | Free | $3,000/month | Based on policies |
| Layer | Layer 7 | Layer 3/4 | Layer 3/4/7 | Management |
| Scope | Web apps | All AWS | Protected resources | Organization-wide |
28.2 AWS WAF (Web Application Firewall)
Section titled “28.2 AWS WAF (Web Application Firewall)”WAF Architecture
Section titled “WAF Architecture” AWS WAF Architecture+------------------------------------------------------------------+| || Internet || | || v || +----------------+ || | CloudFront | || | or ALB | || +----------------+ || | || v || +----------------+ || | AWS WAF | || +----------------+ || | || +-------------------+-------------------+ || | | | || v v v || +----------+ +----------+ +----------+ || | Web ACL | | Rule | | IP Set | || | | | Groups | | | || | - Default| | | | - Allow | || | Action | | - Managed| | - Block | || | - Rules | | - Custom | | Lists | || +----------+ +----------+ +----------+ || |+------------------------------------------------------------------+WAF Components
Section titled “WAF Components” WAF Components+------------------------------------------------------------------+| || Web ACL (Access Control List) || +------------------------------------------------------------+ || | - Central resource for WAF configuration | || | - Contains rules and rule groups | || | - Has default action (allow or block) | || | - Associated with CloudFront, ALB, or API Gateway | || +------------------------------------------------------------+ || || Rules || +------------------------------------------------------------+ || | - Define matching criteria and actions | || | - Can be custom or managed | || | - Actions: Allow, Block, Count, Captcha | || +------------------------------------------------------------+ || || Rule Groups || +------------------------------------------------------------+ || | - Collection of rules | || | - Managed rule groups (AWS, AWS Marketplace) | || | - Custom rule groups | || +------------------------------------------------------------+ || || IP Sets || +------------------------------------------------------------+ || | - List of IP addresses/ranges | || | - Used for allow/block lists | || | - Up to 10,000 IP addresses per set | || +------------------------------------------------------------+ || || Regex Patterns || +------------------------------------------------------------+ || | - Regular expression patterns | || | - Used for complex matching | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+Rule Types
Section titled “Rule Types” WAF Rule Types+------------------------------------------------------------------+| || Managed Rule Groups || +------------------------------------------------------------+ || | | || | AWS Managed Rules: | || | +------------------------------------------------------+ | || | | - AWSManagedRulesCommonRuleSet (Core rule set) | | || | | - AWSManagedRulesAnonymousIpList (Anonymous IP) | | || | | - AWSManagedRulesSQLiRuleSet (SQL injection) | | || | | - AWSManagedRulesLinuxRuleSet (Linux specific) | | || | | - AWSManagedRulesUnixRuleSet (Unix specific) | | || | | - AWSManagedRulesWindowsRuleSet (Windows specific) | | || | +------------------------------------------------------+ | || | | || | Vendor Managed Rules (AWS Marketplace): | || | +------------------------------------------------------+ | || | | - Fortinet, Imperva, Trend Micro, etc. | | || | +------------------------------------------------------+ | || | | || +------------------------------------------------------------+ || || Custom Rules || +------------------------------------------------------------+ || | | || | Rate-based Rules: | || | +------------------------------------------------------+ | || | | - Limit requests from IP address | | || | | - Configurable rate (100-2,000,000 requests/5min) | | || | +------------------------------------------------------+ | || | | || | Regular Rules: | || | +------------------------------------------------------+ | || | | - IP match (IP sets) | | || | | - Geographic match (country codes) | | || | | - String match (query string, headers, body) | | || | | - Regex match (pattern matching) | | || | | - Size constraint (request size) | | || | | - SQL injection match | | || | | - XSS match | | || | +------------------------------------------------------+ | || | | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+WAF Rule Evaluation
Section titled “WAF Rule Evaluation” WAF Rule Evaluation Flow+------------------------------------------------------------------+| || Incoming Request || | || v || +------------------------+ || | Check Web ACL Rules | || +------------------------+ || | || +------------------+------------------+ || | | | || v v v || +--------+ +--------+ +--------+ || | Rule 1 | | Rule 2 | | Rule N | || | Match? | | Match? | | Match? | || +--------+ +--------+ +--------+ || | | | || v v v || +--------+ +--------+ +--------+ || | Action | | Action | | Action | || +--------+ +--------+ +--------+ || | | | || +------------------+------------------+ || | || v || +------------------------+ || | Any Block Action? | || +------------------------+ || | | || Yes No || | | || v v || +----------+ +------------------+ || | BLOCK | | Default Action | || | (403) | | (Allow/Block) | || +----------+ +------------------+ || |+------------------------------------------------------------------+WAF CLI Commands
Section titled “WAF CLI Commands”# Create IP setaws wafv2 create-ip-set \ --name "BlockedIPs" \ --scope REGIONAL \ --ip-address-version IPV4 \ --addresses "192.0.2.0/24" "203.0.113.0/24"
# Create web ACLaws wafv2 create-web-acl \ --name "MyWebACL" \ --scope REGIONAL \ --default-action Allow={} \ --rules file://rules.json
# List web ACLsaws wafv2 list-web-acls \ --scope REGIONAL
# Get web ACLaws wafv2 get-web-acl \ --name "MyWebACL" \ --scope REGIONAL \ --id "abc123"
# Associate web ACL with ALBaws wafv2 associate-web-acl \ --web-acl-arn "arn:aws:wafv2:..." \ --resource-arn "arn:aws:elasticloadbalancing:..."
# Create rule groupaws wafv2 create-rule-group \ --name "MyRuleGroup" \ --scope REGIONAL \ --capacity 50028.3 AWS Shield
Section titled “28.3 AWS Shield”Shield Overview
Section titled “Shield Overview” AWS Shield Overview+------------------------------------------------------------------+| || +------------------------+ || | AWS Shield | || +------------------------+ || | || +---------------------+---------------------+ || | | || v v || +----------+ +----------+ || | Shield | | Shield | || | Standard | | Advanced | || | | | | || | - FREE | | - $3,000/mo| || | - Layer | | - Layer | || | 3/4 | | 3/4/7 | || | - Auto | | - DDoS | || | Enabled| | Response| || +----------+ | - Support| || +----------+ || |+------------------------------------------------------------------+Shield Standard vs Advanced
Section titled “Shield Standard vs Advanced” Shield Standard vs Advanced+------------------------------------------------------------------+| || Feature | Standard | Advanced || -----------------------|-----------------|---------------------- || Cost | FREE | $3,000/month + usage || Layer 3/4 Protection | Yes | Yes || Layer 7 Protection | No | Yes (with WAF) || DDoS Response Team | No | Yes (24/7) || Cost Protection | No | Yes || Visibility | Basic | Advanced || Proactive Engagement | No | Yes || Auto Enrollment | Yes (all AWS) | Manual || |+------------------------------------------------------------------+Shield Advanced Architecture
Section titled “Shield Advanced Architecture” Shield Advanced Architecture+------------------------------------------------------------------+| || Internet || | || v || +----------------+ || | AWS Shield | || | Advanced | || +----------------+ || | || +-------------------+-------------------+ || | | | || v v v || +----------+ +----------+ +----------+ || |CloudFront| | ALB | | Route 53 | || +----------+ +----------+ +----------+ || | | | || +-------------------+-------------------+ || | || v || +----------------+ || | DDoS Response | || | Team (DRT) | || +----------------+ || | || v || +----------------+ || | AWS Support | || | Center | || +----------------+ || |+------------------------------------------------------------------+Shield Protected Resources
Section titled “Shield Protected Resources” Shield Advanced Protected Resources+------------------------------------------------------------------+| || Supported Resources || +------------------------------------------------------------+ || | | || | +------------------+ +------------------+ | || | | Amazon CloudFront| | Route 53 | | || | | (Global) | | (Global) | | || | +------------------+ +------------------+ | || | | || | +------------------+ +------------------+ | || | | Application Load | | Global Accelerator| | || | | Balancer | | | | || | +------------------+ +------------------+ | || | | || | +------------------+ +------------------+ | || | | Network Load | | AWS Elastic IP | | || | | Balancer | | | | || | +------------------+ +------------------+ | || | | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+Shield CLI Commands
Section titled “Shield CLI Commands”# Create protection (Shield Advanced)aws shield create-protection \ --name "MyProtection" \ --resource-arn "arn:aws:cloudfront::..."
# List protectionsaws shield list-protections
# Describe protectionaws shield describe-protection \ --protection-id "abc123"
# Describe DDoS attackaws shield describe-attack \ --attack-id "attack-123"
# List attacksaws shield list-attacks \ --start-time From=2024-01-01T00:00:00Z,To=2024-01-31T23:59:59Z
# Engage DRT (DDoS Response Team)aws shield create-drt-access \ --role-arn "arn:aws:iam::..." \ --log-s3-bucket "my-ddos-logs"28.4 AWS Firewall Manager
Section titled “28.4 AWS Firewall Manager”Firewall Manager Overview
Section titled “Firewall Manager Overview” AWS Firewall Manager Architecture+------------------------------------------------------------------+| || +------------------------+ || | Firewall Manager | || +------------------------+ || | || +---------------------+---------------------+ || | | | || v v v || +----------+ +----------+ +----------+ || | WAF | | Shield | | Security | || | Policies | | Advanced | | Groups | || | | | Policies | | | || +----------+ +----------+ +----------+ || | | | || v v v || +----------+ +----------+ +----------+ || | Apply to | | Apply to | | Apply to | || | All | | Protected| | VPCs | || | Accounts | | Resources| | | || +----------+ +----------+ +----------+ || |+------------------------------------------------------------------+Firewall Manager Policy Types
Section titled “Firewall Manager Policy Types” Firewall Manager Policy Types+------------------------------------------------------------------+| || WAF Policy || +------------------------------------------------------------+ || | - Deploy WAF rules across accounts | || | - Ensure consistent web protection | || | - Automatic remediation of non-compliant resources | || +------------------------------------------------------------+ || || Shield Advanced Policy || +------------------------------------------------------------+ || | - Auto-enroll resources in Shield Advanced | || | - Apply protection to new resources | || | - Ensure DDoS protection across organization | || +------------------------------------------------------------+ || || Security Group Policy || +------------------------------------------------------------+ || | - Manage security groups across accounts | || | - Enforce common security group rules | || | - Audit and remediate non-compliant rules | || +------------------------------------------------------------+ || || Network Firewall Policy || +------------------------------------------------------------+ || | - Deploy AWS Network Firewall rules | || | - Centralized network traffic inspection | || | - Intrusion prevention and detection | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+Firewall Manager Workflow
Section titled “Firewall Manager Workflow” Firewall Manager Policy Workflow+------------------------------------------------------------------+| || 1. Create Policy || +------------------------------------------------------------+ || | - Define policy type (WAF, Shield, Security Group) | || | - Configure rules and settings | || | - Set remediation action | || +------------------------------------------------------------+ || | || v || 2. Define Scope || +------------------------------------------------------------+ || | - Select accounts (all or specific) | || | - Select resources (by tags or types) | || | - Exclude specific resources | || +------------------------------------------------------------+ || | || v || 3. Apply Policy || +------------------------------------------------------------+ || | - Automatic deployment to matching resources | || | - Continuous compliance monitoring | || | - Automatic remediation of violations | || +------------------------------------------------------------+ || | || v || 4. Monitor and Audit || +------------------------------------------------------------+ || | - View compliance status | || | - Review violations | || | - Update policy as needed | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+28.5 AWS Network Firewall
Section titled “28.5 AWS Network Firewall”Network Firewall Overview
Section titled “Network Firewall Overview” AWS Network Firewall Architecture+------------------------------------------------------------------+| || Internet || | || v || +----------------+ || | Internet | || | Gateway | || +----------------+ || | || v || +----------------+ || | Network | || | Firewall | || | Endpoint | || +----------------+ || | || +-------------------+-------------------+ || | | || v v || +----------+ +----------+ || | Public | | Private | || | Subnets | | Subnets | || +----------+ +----------+ || |+------------------------------------------------------------------+Network Firewall Components
Section titled “Network Firewall Components” Network Firewall Components+------------------------------------------------------------------+| || Firewall Policy || +------------------------------------------------------------+ || | - Collection of rule groups | || | - Stateless and stateful rule groups | || | - Default actions | || +------------------------------------------------------------+ || || Rule Groups || +------------------------------------------------------------+ || | | || | Stateless Rule Groups: | || | +------------------------------------------------------+ | || | | - Process first, before stateful rules | | || | | - Use 5-tuple matching (src, dst, port, protocol) | | || | | - Actions: Pass, Drop, Forward to stateful | | || | +------------------------------------------------------+ | || | | || | Stateful Rule Groups: | || | +------------------------------------------------------+ | || | | - Deep packet inspection | | || | | - Suricata-compatible rules | | || | | - Domain list filtering | | || | | - Intrusion prevention (IPS) | | || | +------------------------------------------------------+ | || | | || +------------------------------------------------------------+ || || Firewall Endpoint || +------------------------------------------------------------+ || | - Deployed in subnet | || | - Processes traffic | || | - Scales automatically | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+28.6 Security Best Practices
Section titled “28.6 Security Best Practices”WAF Best Practices
Section titled “WAF Best Practices” WAF Security Best Practices+------------------------------------------------------------------+| || 1. Start with managed rule groups || +------------------------------------------------------------+ || | - Use AWS managed rules as baseline | || | - Add custom rules for specific needs | || +------------------------------------------------------------+ || || 2. Use COUNT mode for testing || +------------------------------------------------------------+ || | - Test rules in COUNT mode first | || | - Analyze logs before blocking | || | - Switch to BLOCK after validation | || +------------------------------------------------------------+ || || 3. Implement rate limiting || +------------------------------------------------------------+ || | - Protect against brute force attacks | || | - Set appropriate thresholds | || +------------------------------------------------------------+ || || 4. Enable logging || +------------------------------------------------------------+ || | - Send logs to S3, CloudWatch, or Kinesis | || | - Analyze for threats and tuning | || +------------------------------------------------------------+ || || 5. Use CAPTCHA for suspicious requests || +------------------------------------------------------------+ || | - Challenge suspicious traffic | || | - Reduce false positives | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+Shield Best Practices
Section titled “Shield Best Practices” Shield Best Practices+------------------------------------------------------------------+| || 1. Enable Shield Advanced for critical applications || +------------------------------------------------------------+ || | - Get 24/7 DDoS response team support | || | - Protect against large-scale attacks | || +------------------------------------------------------------+ || || 2. Configure proactive engagement || +------------------------------------------------------------+ || | - DRT can respond during attacks | || | - Enable access to your environment | || +------------------------------------------------------------+ || || 3. Set up health checks || +------------------------------------------------------------+ || | - Route 53 health checks for automatic failover | || | - CloudWatch alarms for monitoring | || +------------------------------------------------------------+ || || 4. Enable DDoS detection metrics || +------------------------------------------------------------+ || | - Monitor DDoSAttackIO and DDoSAttackPackets | || | - Set up alerts for attack detection | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+28.7 Integration with Other Services
Section titled “28.7 Integration with Other Services”WAF + CloudFront + Shield Integration
Section titled “WAF + CloudFront + Shield Integration” Integrated Security Architecture+------------------------------------------------------------------+| || Internet || | || v || +----------------+ || | AWS Shield | || | Standard | || | (Layer 3/4) | || +----------------+ || | || v || +----------------+ || | CloudFront | || | Distribution | || +----------------+ || | || v || +----------------+ || | AWS WAF | || | (Layer 7) | || +----------------+ || | || v || +----------------+ || | Application | || | Load Balancer | || +----------------+ || | || v || +----------------+ || | EC2 / ECS / | || | Lambda | || +----------------+ || |+------------------------------------------------------------------+28.8 Troubleshooting
Section titled “28.8 Troubleshooting”Common Issues
Section titled “Common Issues” Common WAF Issues+------------------------------------------------------------------+| || Issue 1: Legitimate traffic being blocked || +------------------------------------------------------------+ || | Cause: Overly restrictive rules | || | Solution: Use COUNT mode to test, adjust rules | || +------------------------------------------------------------+ || || Issue 2: WAF not blocking expected traffic || +------------------------------------------------------------+ || | Cause: Rule order or default action misconfigured | || | Solution: Check rule priority and default action | || +------------------------------------------------------------+ || || Issue 3: High latency after WAF deployment || +------------------------------------------------------------+ || | Cause: Too many rules or complex regex patterns | || | Solution: Optimize rules, use simpler patterns | || +------------------------------------------------------------+ || || Issue 4: Shield Advanced not protecting resources || +------------------------------------------------------------+ || | Cause: Resources not enrolled in protection | || | Solution: Create protection for each resource | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+28.9 Exam Tips
Section titled “28.9 Exam Tips”
Key Exam Points+------------------------------------------------------------------+| || 1. WAF operates at Layer 7 (Application layer) || || 2. Shield Standard is FREE and automatically enabled || || 3. Shield Advanced costs $3,000/month + includes DRT support || || 4. WAF can be attached to CloudFront, ALB, and API Gateway || || 5. Managed rule groups provide pre-configured protection || || 6. Rate-based rules limit requests per IP address || || 7. Firewall Manager centralizes security policy management || || 8. Network Firewall provides VPC-level protection || || 9. WAF default action determines behavior when no rules match || || 10. Use COUNT mode to test rules before blocking || |+------------------------------------------------------------------+28.10 Summary
Section titled “28.10 Summary” Chapter 28 Summary+------------------------------------------------------------------+| || AWS WAF || +------------------------------------------------------------+ || | - Web Application Firewall for Layer 7 protection | || | - Managed and custom rules | || | - IP sets, regex patterns, rate limiting | || | - Actions: Allow, Block, Count, Captcha | || +------------------------------------------------------------+ || || AWS Shield || +------------------------------------------------------------+ || | - Standard: Free, Layer 3/4, auto-enabled | || | - Advanced: $3,000/mo, Layer 3/4/7, DRT support | || | - DDoS protection for all AWS services | || +------------------------------------------------------------+ || || AWS Firewall Manager || +------------------------------------------------------------+ || | - Centralized security policy management | || | - Works with WAF, Shield, Security Groups | || | - Organization-wide deployment | || +------------------------------------------------------------+ || |+------------------------------------------------------------------+Previous Chapter: Chapter 27: AWS KMS, Secrets Manager & Parameter Store Next Chapter: Chapter 29: AWS Security Hub & Detective