Web ACLs with managed rules

Scenario

Suppose you are a solo developer starting with a Juice Shop. Your website is a simple web application running with a SQL database. For some reason, the Milkshake hacker group is starting to attack your website.

Fortunately, you are now approaching AWS WAF. So you decide to deploy WAF to protect your website.

Additionally, you don’t have much time right now, so you will decide to use the pre-built rule groups by AWS for your Web ACL. With these rules, your website will be protected from common attacks from the Milkshake group.

Web ACLs with managed rules

Web ACLs (Web Access Control List) are the core of AWS WAF deployment. It includes rules used to evaluate requests sent to your WAF. Web ACLs are applied to your web application through Amazon CloudFront distribution, AWS API Gateway API, or an AWS Application Load Balancer.
Managed rule groups are a set of rules created and updated by AWS teams or third parties on AWS Marketplace. These rules provide protection for your application from common attacks or specific to each application type.

  1. Access WAF & Shield

Create the sample web app

This lab uses the latest version of AWS WAF. Make sure you are not using WAF Classic.

  • Click Create web ACL. Create the sample web app
  1. In the Web ACL details section.
  • In the App category field, Click E-commerce & transaction platforms.
  • In the App focus field, select Both API and web.
  • In the Add resources field, select App CloudFont or Amplify resources.

Create the sample web app

  • Select the CloudFront distribution just created, then click Add Create the sample web app

  1. Select You build in, then select AWS-managed rule group, continue to select Next Create the sample web app

  2. Select Core rule set, then proceed to Add rule Create the sample web app Create the sample web app

  3. Confirm the rule has been created. We continue to select Add rule to add a new rule. Create the sample web app

  • Select AWS-managed rule group, click Next.

  • Select SQL database.

  • Select Add rule to add the rule. Create the sample web app Create the sample web app Create the sample web app

  • Confirm 2 new rules have been created. Create the sample web app

  1. In the Name & describe section

  • In the name field, enter waf-workshop-juice-shop.

  • Enter description Web ACL for the aws-waf-workshop.

  • In Logging destination type, select S3 Bucket.

  • Select the S3 bucket just created.

  • Finally, select Create protection pack (web ACL) Create the sample web app

  • Confirm successful creation. Create the sample web app

  1. Run the command
# This imitates a Cross Site Scripting attack
# This request should be blocked.
curl -X POST  <Your Juice Shop URL> -F "user='<script><alert>Hello></alert></script>'"

We will see the result is Request blocked. Create the sample web app

  1. Run the command.
# This imitates a SQL Injection attack
# This request should be blocked.
curl -X POST <Your Juice Shop URL> -F "user='AND 1=1;"

We will see the result is Request blocked.
Create the sample web app