Amazon’s AWS WAF web application firewall service is built specifically to protect cloud apps from a whole range of Internet threats. Learn how it works.
We all know that web applications are vulnerable to attacks, and that deploying your application from the cloud can theoretically expose it to even greater risk. To help secure their web apps, administrators will often use IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) solutions, or a Web Application Firewall. In this post we’re going to focus on WAFs and, in particular, Amazon’s AWS WAF application-level firewall service.
Because it monitors traffic at the application layer, WAF will often be the preferred choice for securing your applications. Let’s see how it works, and how Amazon’s version can take it even further.
Categories of web attacks
Before talking about AWS WAF, it makes sense to review some of the more common vulnerabilities facing web applications.
- DDoS attacks
This is probably the most common attack of them all. Attackers overload an application by sending bulk requests to the web servers. This slows down the application and makes it unavailable for genuine requests. This can significantly hurt the value of a brand and also affect business.
- SQL injections
An attacker can run malicious SQL queries on websites or applications using SQL based databases. If the databases aren’t secured, attackers can access confidential account and business information.
Here’s an example of SQL injection:
SELECT id FROM users WHERE username=’username’ AND password=’password’ OR 1=1’
The above statement – even using an incorrect username or password – will always return a result.
- Cross site scripting
If your application is vulnerable to cross site scripting then the attacker can run or inject malicious scripts, generally in the form of a browser side script. If your end user is accessing a vulnerable application, his browser has no way to know that the script should not be trusted, and will execute it. These scripts can even rewrite the content of the HTML page.
These threats should certainly give us some worry. But hey, all is not lost. The web application firewall is there to help. There are many WAF tools available on the market like ModSecurity, WebCastellum, OpenWAF, and Barracuda. But now there’s also AWS WAF.
What is AWS WAF?
Now, as we all know, AWS is riding on top of the cloud computing wave. Customers are migrating all kinds of applications to AWS’s infrastructure. But the basic challenges of security remain the same: how can you protect your web applications from all the vulnerabilities we’ve discussed (along with those we didn’t mention)? Can I use the traditional WAF tools with the cloud? Will they work with my AWS infrastructure?
Yes and yes. But let’s take it one step at a time. Let’s consider a simple use case. Imagine that you have an application with some web servers, app servers, and a database, all deployed in the AWS cloud. You’d obviously like to secure your application from web attacks. How should you proceed?
The traditional approach would be to set up a firewall in front of your web servers to monitor application traffic before it hits the servers. If you’re using AWS, then most probably, it would sit between Amazon’s load balancer and the servers. You could also place it in front of the load balancer.
Watch this short video which is part of the Cloud Academy’s Protecting Web Apps with AWS WAF, Shield & Firewall Manager Course.
- Choosing an appropriate WAF solution and managing its availability can really drive you crazy.
- Setup and configuration can be very complex.
- Making sure your WAF solution can keep up with your application as it scales can be a challenge.
- Web traffic monitoring may not be simple.
To address these issues, Amazon has given us AWS WAF, this will protect AWS-powered web applications served by AWS services like Amazon CloudFront from attacks happening at application layer.
AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF gives you control over which traffic to allow or block to your web application by defining customizable web security rules.
How AWS WAF works
Now, instead of provisioning and maintaining your own WAF servers, you can just set up WAF from the AWS console. This will let you define your traffic filtering rules without needing to invest time ensuring proper configuration and availability.
To get started, you only need to create web ACLs. A web ACL contains at least one rule in which you specify conditions that will either block or allow incoming requests. Assuming you’re working with CloudFront, once the web ACL is ready, you can simply attach it to your application’s distribution. It’s important to understand a few key web ACL elements, like Conditions and Rules:
Once you are done with configuring conditions, you can create a rule and attach it to your web ACL. You can attach more than one rule to an ACL.
A Web ACL, with conditions and rules, looks like this:
You’re now ready to associate your new web ACL with an AWS service.
With AWS WAF, you pay only for what you use. There are no minimum fees and no upfront commitments. Your costs will depend on three major variables:
- Number of Web ACLs: each Web ACL will cost you $5/month.
- Number of Rules: $1.00 per rule per web ACL per month.
- Request Count: $0.60 per million web requests.
Things to know about AWS WAF
- Since AWS WAF is integrated with AWS CloudFront – which supports custom origins outside of AWS – it can even be used to protect websites not hosted on AWS.
- You can configure custom error pages.
- Real time metrics can be monitored from CloudWatch.
- AWS WAF can inspect HTTPS traffic.
I hope this post helped give you a clear picture of AWS’s Web application firewall and its implementation.
If you’ve got any thoughts of your own, why not add them to the comments?
Application Load Balancer vs. Classic Load Balancer
What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...
Advantages and Disadvantages of Microservices Architecture
What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...
Kubernetes Services: AWS vs. Azure vs. Google Cloud
Kubernetes is a popular open-source container orchestration platform that allows us to deploy and manage multi-container applications at scale. Businesses are rapidly adopting this revolutionary technology to modernize their applications. Cloud service providers — such as Amazon Web Ser...
AWS Internet of Things (IoT): The 3 Services You Need to Know
The Internet of Things (IoT) embeds technology into any physical thing to enable never-before-seen levels of connectivity. IoT is revolutionizing industries and creating many new market opportunities. Cloud services play an important role in enabling deployment of IoT solutions that min...
Which Certifications Should I Get?
As we mentioned in an earlier post, the old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and compan...
How to Go Serverless Like a Pro
So, no servers? Yeah, I checked and there are definitely no servers. Well...the cloud service providers do need servers to host and run the code, but we don’t have to worry about it. Which operating system to use, how and when to run the instances, the scalability, and all the arch...
AWS Security: Bastion Hosts, NAT instances and VPC Peering
Effective security requires close control over your data and resources. Bastion hosts, NAT instances, and VPC peering can help you secure your AWS infrastructure. Welcome to part four of my AWS Security overview. In part three, we looked at network security at the subnet level. This ti...
Top 13 Amazon Virtual Private Cloud (VPC) Best Practices
Amazon Virtual Private Cloud (VPC) brings a host of advantages to the table, including static private IP addresses, Elastic Network Interfaces, secure bastion host setup, DHCP options, Advanced Network Access Control, predictable internal IP ranges, VPN connectivity, movement of interna...
Big Changes to the AWS Certification Exams
With AWS re:Invent 2019 just around the corner, we can expect some early announcements to trickle through with upcoming features and services. However, AWS has just announced some big changes to their certification exams. So what’s changing and what’s new? There is a brand NEW ...
New on Cloud Academy: ITIL® 4, Microsoft 365 Tenant, Jenkins, TOGAF® 9.1, and more
At Cloud Academy, we're always striving to make improvements to our training platform. Based on your feedback, we released some new features to help make it easier for you to continue studying. These new features allow you to: Remove content from “Continue Studying” section Disc...
AWS Security Groups: Instance Level Security
Instance security requires that you fully understand AWS security groups, along with patching responsibility, key pairs, and various tenancy options. As a precursor to this post, you should have a thorough understanding of the AWS Shared Responsibility Model before moving onto discussi...
Cloud Migration Risks & Benefits
If you’re like most businesses, you already have at least one workload running in the cloud. However, that doesn’t mean that cloud migration is right for everyone. While cloud environments are generally scalable, reliable, and highly available, those won’t be the only considerations dri...