AWS WAF (Web Application Firewall) and Application Security

Amazon’s AWS WAF web application firewall service is built specifically to protect cloud apps from a whole range of Internet threats. Learn how it works.

We all know that web applications are vulnerable to attacks, and that deploying your application from the cloud can theoretically expose it to even greater risk. To help secure their web apps, administrators will often use IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) solutions, or a Web Application Firewall. In this post we’re going to focus on WAFs and, in particular, Amazon’s AWS WAF application-level firewall service.

Because it monitors traffic at the application layer, WAF will often be the preferred choice for securing your applications. Let’s see how it works, and how Amazon’s version can take it even further.

Categories of web attacks

Before talking about AWS WAF, it makes sense to review some of the more common vulnerabilities facing web applications.

  • DDoS attacks

This is probably the most common attack of them all. Attackers overload an application by sending bulk requests to the web servers. This slows down the application and makes it unavailable for genuine requests. This can significantly hurt the value of a brand and also affect business.

  • SQL injections

An attacker can run malicious SQL queries on websites or applications using SQL based databases. If the databases aren’t secured, attackers can access confidential account and business information.

Here’s an example of SQL injection:

SELECT id FROM users WHERE username=’username’ AND password=’passwordOR 1=1’

The above statement – even using an incorrect username or password – will always return a result.

  • Cross site scripting

If your application is vulnerable to cross site scripting then the attacker can run or inject malicious scripts, generally in the form of a browser side script. If your end user is accessing a vulnerable application, his browser has no way to know that the script should not be trusted, and will execute it. These scripts can even rewrite the content of the HTML page.

These threats should certainly give us some worry. But hey, all is not lost. The web application firewall is there to help. There are many WAF tools available on the market like ModSecurity, WebCastellum, OpenWAF, and Barracuda. But now there’s also AWS WAF.

What is AWS WAF?

Now, as we all know, AWS is riding on top of the cloud computing wave. Customers are migrating all kinds of applications to AWS’s infrastructure. But the basic challenges of security remain the same: how can you protect your web applications from all the vulnerabilities we’ve discussed (along with those we didn’t mention)? Can I use the traditional WAF tools with the cloud? Will they work with my AWS infrastructure?

Yes and yes. But let’s take it one step at a time. Let’s consider a simple use case. Imagine that you have an application with some web servers, app servers, and a database, all deployed in the AWS cloud. You’d obviously like to secure your application from web attacks. How should you proceed?

The traditional approach would be to set up a firewall in front of your web servers to monitor application traffic before it hits the servers. If you’re using AWS, then most probably, it would sit between Amazon’s load balancer and the servers. You could also place it in front of the load balancer.

Watch this short video which is part of the Cloud Academy’s Protecting Web Apps with AWS WAF, Shield & Firewall Manager Course.

 

Design considerations

  • Choosing an appropriate WAF solution and managing its availability can really drive you crazy.
  • Setup and configuration can be very complex.
  • Making sure your WAF solution can keep up with your application as it scales can be a challenge.
  • Web traffic monitoring may not be simple.

To address these issues, Amazon has given us AWS WAF, this will protect AWS-powered web applications served by AWS services like Amazon CloudFront from attacks happening at application layer.

AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF gives you control over which traffic to allow or block to your web application by defining customizable web security rules.

How AWS WAF works

Now, instead of provisioning and maintaining your own WAF servers, you can just set up WAF from the AWS console. This will let you define your traffic filtering rules without needing to invest time ensuring proper configuration and availability.

To get started, you only need to create web ACLs. A web ACL contains at least one rule in which you specify conditions that will either block or allow incoming requests. Assuming you’re working with CloudFront, once the web ACL is ready, you can simply attach it to your application’s distribution. It’s important to understand a few key web ACL elements, like Conditions and Rules:

WAF Conditions

For your rules to work, you will need to specify the filter condition for your web ACL:
AWS WAF IP match conditions
AWS WAF SQL injection match conditions

WAF Rules

Once you are done with configuring conditions, you can create a rule and attach it to your web ACL. You can attach more than one rule to an ACL.
AWS WAF creating rulesA Web ACL, with conditions and rules, looks like this:
AWS WAF Web ACL example
AWS WAF Default action
You’re now ready to associate your new web ACL with an AWS service.

Pricing

With AWS WAF, you pay only for what you use. There are no minimum fees and no upfront commitments. Your costs will depend on three major variables:

  • Number of Web ACLs: each Web ACL will cost you $5/month.
  • Number of Rules: $1.00 per rule per web ACL per month.
  • Request Count: $0.60 per million web requests.

Things to know about AWS WAF

  • Since AWS WAF is integrated with AWS CloudFront – which supports custom origins outside of AWS – it can even be used to protect websites not hosted on AWS.
  • You can configure custom error pages.
  • Real time metrics can be monitored from CloudWatch.
  • AWS WAF can inspect HTTPS traffic.

I hope this post helped give you a clear picture of AWS’s Web application firewall and its implementation.

If you’ve got any thoughts of your own, why not add them to the comments?

Avatar

Written by

Vineet Badola

Working as a cloud professional for last 6 years in various organizations, I have experience in three of the most popular cloud platforms, AWS IaaS, Microsoft Azure and Pivotal Cloud Foundry PaaS platform. Having around 10 years of IT experience in various roles and I take great interest in learning and sharing my knowledge on newer technologies. Wore many hats as developer, lead, architect in cloud technologies implementation. During Leisure time I enjoy good soothing music, playing TT and sweating out in Gym. I believe sharing knowledge is my way to make this world a better place.


Related Posts

Alisha Reyes
Alisha Reyes
— January 6, 2020

New on Cloud Academy: Red Hat, Agile, OWASP Labs, Amazon SageMaker Lab, Linux Command Line Lab, SQL, Git Labs, Scrum Master, Azure Architects Lab, and Much More

Happy New Year! We hope you're ready to kick your training in overdrive in 2020 because we have a ton of new content for you. Not only do we have a bunch of new courses, hands-on labs, and lab challenges on AWS, Azure, and Google Cloud, but we also have three new courses on Red Hat, th...

Read more
  • agile
  • AWS
  • Azure
  • Google Cloud Platform
  • Linux
  • OWASP
  • programming
  • red hat
  • scrum
Alisha Reyes
Alisha Reyes
— December 24, 2019

Cloud Academy’s Blog Digest: Azure Best Practices, 6 Reasons You Should Get AWS Certified, Google Cloud Certification Prep, and more

Happy Holidays from Cloud Academy We hope you have a wonderful holiday season filled with family, friends, and plenty of food. Here at Cloud Academy, we are thankful for our amazing customer like you.  Since this time of year can be stressful, we’re sharing a few of our latest article...

Read more
  • AWS
  • azure best practices
  • blog digest
  • Cloud Academy
  • Google Cloud
Avatar
Guy Hummel
— December 12, 2019

Google Cloud Platform Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— December 10, 2019

New Lab Challenges: Push Your Skills to the Next Level

Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...

Read more
  • AWS
  • Azure
  • Google Cloud
  • hands-on
  • labs
Alisha Reyes
Alisha Reyes
— December 5, 2019

New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More

Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...

Read more
  • AWS
  • AWS solution architect
  • AZ-203
  • Azure
  • cyber security
  • FCCS
  • Foundation Certificate in Cyber Security
  • Google Cloud Platform
  • Kubernetes
Avatar
Cloud Academy Team
— December 4, 2019

Understanding Enterprise Cloud Migration

What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...

Read more
  • AWS
  • Azure
  • Data Migration
Wendy Dessler
Wendy Dessler
— November 27, 2019

6 Reasons Why You Should Get an AWS Certification This Year

In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...

Read more
  • AWS
  • Certifications
  • certified
Avatar
Andrea Colangelo
— November 26, 2019

AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around

The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...

Read more
  • AWS
Avatar
Dzenan Dzevlan
— November 20, 2019

Application Load Balancer vs. Classic Load Balancer

What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...

Read more
  • ALB
  • Application Load Balancer
  • AWS
  • Elastic Load Balancer
  • ELB
Albert Qian
Albert Qian
— November 13, 2019

Advantages and Disadvantages of Microservices Architecture

What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...

Read more
  • AWS
  • Docker
  • Kubernetes
  • Microservices
Nisar Ahmad
Nisar Ahmad
— November 12, 2019

Kubernetes Services: AWS vs. Azure vs. Google Cloud

Kubernetes is a popular open-source container orchestration platform that allows us to deploy and manage multi-container applications at scale. Businesses are rapidly adopting this revolutionary technology to modernize their applications. Cloud service providers — such as Amazon Web Ser...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Kubernetes
Avatar
Stuart Scott
— October 31, 2019

AWS Internet of Things (IoT): The 3 Services You Need to Know

The Internet of Things (IoT) embeds technology into any physical thing to enable never-before-seen levels of connectivity. IoT is revolutionizing industries and creating many new market opportunities. Cloud services play an important role in enabling deployment of IoT solutions that min...

Read more
  • AWS
  • AWS IoT Events
  • AWS IoT SiteWise
  • AWS IoT Things Graph
  • IoT