CODEWITHSUNDEEP
amazon-web-servicesaws-api-gatewayamazon-waf
Ludo
Ludo

Reputation: 5280

WAF Standard Rules: Do we really have to configure everything manually?

I am trying to configure a WAF with my Api Gateway and i am surprised AWS is not offering templates of rules (such as the owasp top 10).

For SQL injections for example, everybody use the same rules am i wrong?

Do you know a way to import the main security rules without having to configure it manually?

Upvotes: 3

Views: 654

Answers (2)

James Dean
James Dean

Reputation: 4421

OWASP Top 10 template is available, the rest of it you need to create.

https://aws.amazon.com/about-aws/whats-new/2017/07/use-aws-waf-to-mitigate-owasps-top-10-web-application-vulnerabilities/

The template is available at: https://s3.us-east-2.amazonaws.com/awswaf-owasp/owasp_10_base.yml

Upvotes: 0

Martin Löper
Martin Löper

Reputation: 6649

As far as I know there is a marketplace offering called Managed rules for AWS Web Application Firewall [1] which does exactly what you ask for. There are 3rd party sellers (more precisely: AWS partner companies) which offer rules for the OWASP Top 10. [2]

The offering exists since November 2017. [3]
More information about the scope of existing rules is given in a newer blog post from 2018. [4]

The corresponding implementation in the WAF service is called AWS Marketplace Rule Groups in the docs. [5]

References

[1] https://aws.amazon.com/marketplace/solutions/security/waf-managed-rules
[2] https://aws.amazon.com/marketplace/search/results?x=0&y=0&searchTerms=owasp
[3] https://aws.amazon.com/about-aws/whats-new/2017/11/ready-to-use-managed-rules-now-available-on-aws-waf/?nc1=h_ls
[4] https://aws.amazon.com/about-aws/whats-new/2018/02/new-products-for-managed-rules-on-aws-waf/?nc1=h_ls
[5] https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups.html

Upvotes: 2

Related Questions