WAF, Shield and Firewall Manager

What it is

Three services protect the edge of an application. AWS WAF (Web Application Firewall) filters HTTP and HTTPS requests at layer 7, AWS Shield defends against distributed denial of service (DDoS) attacks, and AWS Firewall Manager applies these protections consistently across an organization.

Together they answer "how do we block bad web traffic and survive floods without managing every account by hand?".

How it works

AWS WAF

A web ACL (access control list) holds an ordered list of rules and a default action. WAF evaluates rules by priority, and the first terminating match decides the result. A web ACL can be associated with CloudFront, an Application Load Balancer, Amazon API Gateway REST APIs, AWS AppSync, Amazon Cognito user pools and some other resources.

It cannot be attached to a Network Load Balancer.

For CloudFront, create the web ACL with the global scope in us-east-1. For the other resources, the web ACL is Regional and must be in the same Region as the resource.

Rule actions are Allow, Block, Count, CAPTCHA and Challenge. Count records matches without blocking, which makes it the safe way to test a new rule before enforcing it.

{
  "Name": "RateLimitPerIP",
  "Priority": 1,
  "Statement": {
    "RateBasedStatement": { "Limit": 1000, "AggregateKeyType": "IP" }
  },
  "Action": { "Block": {} },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLimitPerIP"
  }
}

WAF logs go to CloudWatch Logs, S3 or Firehose, with a destination name that starts with aws-waf-logs-. Use logs and sampled requests to tune false positives.

AWS Shield

For layer 7 floods, combine Shield Advanced with WAF rate based rules. Shield Advanced can also create and manage WAF rules for application layer protection on protected resources.

Designing for DDoS resilience

• Put content behind CloudFront and Route 53, which spread load and absorb attacks at the edge.
• Use Auto Scaling and load balancers so capacity grows with demand.
• Hide origins. Restrict ALB security groups to CloudFront and avoid exposing instance addresses.
• Use WAF rate based rules, and scope-down statements to avoid blocking healthy traffic.
• Use Global Accelerator for static anycast addresses for non HTTP workloads.

AWS Firewall Manager

Firewall Manager sets up and enforces policies across accounts in an organization. It needs AWS Organizations, AWS Config, and a designated Firewall Manager administrator account.

A policy scopes to accounts, organizational units, resource types and tags. It can auto remediate: new resources that match the scope get the protection, and resources that do not comply are fixed or reported.

Choosing