Request Logging

Scenario

Your Juice Shop is growing rapidly. Great! Now, you have a set of rules, and you gradually find it difficult to identify which rule is responsible for blocking requests. Thus, logging becomes useful at this point. To do this, you need to enable logging for your Web ACL to an S3 bucket. Your logs contain sensitive headers and named cookies. You don’t want this content to be recorded. Therefore, you need to configure to remove headers from the logs.

Request Logging

WAF uses Amazon Kinesis Firehose for logging. This allows logs to be transferred to any Kinesis Firehose destination, such as Amazon S3, Amazon Redshift, or Amazon Elastic Search. To log requests in your Web ACL, you must create a Kinesis Data Firehose.

  1. Access Amazon Kinesis Console.
  • Click Amazon Data Firehose.
  • Click Create Firehose stream.

Testing new rule

Testing new rule

You need to make sure to create in the us-east-1 region. This is a mandatory requirement for logging CloudFront.

2. In the Choose source and destination section.

  • In the Source field, Select Direct PUT.
  • In the Destination field, Select Amazon S3.
  • In the Firehose stream name field, enter aws-waf-logs-workshop-26.

Testing new rule

The name of the Kinesis Data Firehose will start with aws-waf-logs-workshop-26. This is a mandatory requirement of the WAF service.

  1. In the Destination settings section.

  • Click Browse.

  • Select the S3 bucket created earlier as the destination storage.

  • Click Choose.

Testing new rule

Testing new rule 4. Scroll down, Click Create delivery stream.

Testing new rule 5. Access AWS WAF Console

  • Click your Web ACLs.
  • Select Configure logging sampled requests.

Testing new rule 6. On the Configure logging information page.

  • Select Edit
  • Select the Logging destination tab.

Testing new rule

  1. In the Logging destination section.
  • Select Amazon Data Firehose stream.
  • In the Amazon Kinesis Data Firehose delivery stream field, Select aws-waf-logs-workshop-26.

Testing new rule 8. In the Redacted fields section.

  • In the Redacted headers field, click Add header
  • Add the header value Cookie.
  • Click Save

Testing new rule 9. Run the following commands in sequence

curl "<Your Juice Shop URL>?username=admin"
curl "<Your Juice Shop URL>?milkshake=banana&favourite-topping=sauce"
curl -H "x-milkshake: chocolate" "<Your Juice Shop URL>"

Testing new rule

Testing new rule

Testing new rule 10. Access your S3 bucket following the path as shown and download the log file recorded in S3.

Testing new rule 11. Search for the keyword Cookie in the file, you will see all values are REDACTED.

Testing new rule

Conclusion

WAF allows you to record request logs and store them in the Kinesis Data Firehose destination storage. Logs provide information about requests. Logs also provide the action and rule that affected the request. This information may not be valuable when you run WAF. Use the content redaction feature to remove sensitive information.