SQL database: contains rules to block request patterns. Web ACLs can be applied to CloudFront distributions, Application Load Balancers (ALBs), and API Gateways. The Web ACL uses AWS Managed Rules to protect internet-facing applications.

Formatting your API Gateway’s Application Resource Name (ARN), you will need this to associate it to the WebACL. An AWS WAF Web ACL to protect applications with SQL databases.

YAML indentation - I’d recommend installing cfn-lint, a huge help for formatting YAML files and catching bugs early.

I got the tip on these ahead of my implementation thanks to Natalie’s article. Hence, this post is to help those who are as lost as I was configuring a WAFV2 with an API gateway. Configuring the WAFV2 with an API is pretty straightforward, however, there are little resources available online. After some research I found that many others also faced this issue, mainly because the ‘Classic WAF’ has been depreciated by AWS.ĪWS WAFV2 is the latest version of the AWS WAF API released in November 2019. I ran into an issue where my WebACL would not properly associate to the API. For Region, select the AWS Region where you created your web ACL. In the navigation pane, under AWS WAF, choose Web ACLs. To create this custom rule, complete the following steps: 1.

The only quality documentation I could find was from our very own Natalie Laing in this post she wrote back in 2019. Be sure to override the action for the specific rule that causes the false positive. Evaluate this rule group for use if your.

This can help prevent remote injection of unauthorized queries. The SQL database rule group contains rules to block request patterns associated with exploitation of SQL databases, like SQL injection attacks. I recently had to attach a Web Application Firewall (WAF) regional Access Control List (ACL) to an API gateway created using the Serverless Framework. VendorName: AWS, Name: AWSManagedRulesSQLiRuleSet, WCU: 200.

Awsmanagedrulessqliruleset