kidmam/aws-firewall-factory

Deploy, update, and stage your WAFs while managing them centrally via FMS.

𒋰 Table of contents

• 𒋰 Table of contents
• 🔭 Overview
• 🎬 Media
  • 🔗 Useful Links
• 🗺️ Architecture
• 🧩 Features
• 🛡️ Deployment
  • ⚙️ Prerequisites
  • 🏁 Deployment via Taskfile
• 🦸🏼‍♀️ Contributors
  • 👩‍💻 Contribute
  • 👏 Supporters

Releases	Author
Changelog - Features	David Krohn Linkedin - Blog

🔭 Overview

AWS Web Application Firewalls (WAFs) protect web applications and APIs from typical attacks from the Internet that can compromise security and availability, and put undue strain on servers and resources. The AWS WAF provides prebuilt security rules that help control bot traffic and block attack patterns. You can also create your own rules based on your own requirements. In simple scenarios and for smaller applications, this is very easy to implement on an individual basis. However, in larger environments with tens or even hundreds of applications, it is advisable to aim for central governance and automation. This simple solution helps you deploy, update and stage your Web Application Firewalls while managing them centrally via AWS Firewall Manager.

🎬 Media

If you want to learn more about the AWS Firewall Factory feel free to look at the following media resources.

• 📺 Webinar: Web Application Firewalls at Scale - Language: 🇩🇪
• 📺 Webinar: Managing AWS Web Application Firewalls at Scale - Language: 🇺🇸
• 📺 Webinar: Secure Serverless Applications against OWASP TOP 10 in 5 mins - Language: 🇺🇸
• 📊 Slides: Managing AWS Web Application Firewalls at Scale - Language: 🇺🇸
• Secure Serverless Applications against OWASP TOP 10 in 5 Minutes - Language: 🇺🇸
  • 📊 Slides - 📺 Video
• 🎙 Podcast coming soon

🔗 Useful Links

• 🐦🤖 Twitter Bot to get Notified for Managed Rules Updates
• 🔔 Slack automation to get Notified for Managed Rules Updates
• 🏫 AWS WAF Workshop

🗺️ Architecture

Features

🧩 Features

1. Automated capactiy calculation via API - CheckCapacity

2. Algorithm to split Rules into RuleGroups

3. Automated update of RuleGroup if capacity changed

4. Add ManagedRuleGroups via configuration file

5. Automated generation of draw.io diagram for each WAF

6. Checking of the softlimit quota for WCU set in the AWS account (stop deployment if calculated WCU is above the quota)

7. Easy configuration of WAF rules trough JSON file.

8. Deployment hash to deploy same WAF more than once for testing and/or blue/green deployments.

9. Stopping deployment if soft limit will be exceeded: Firewall Manager policies per organization per Region (L-0B28E140) - Maximum number of web ACL capacity units in a web ACL in WAF for regional (L-D9F31E8A)

10. RegexMatchStatement and IPSetReferenceStatement is working now 🚀

11. You can name your rules. If you define a name in your RulesArray, the name + a Base36 timestamp will be used for the creation of your rule - otherwise a name will be generated. This will help you to query your logs in Athena. The same rule name also applies to the metric by adding "-metric" to the name.

12. Support for Captcha - You can add Captcha as an action to your WAFs. This helps you block unwanted bot traffic by requiring users to successfully complete challenges before their web request are allowed to reach AWS WAF protected resources. AWS WAF Captcha is available in the US East (N. Virginia), US West (Oregon), Europe (Frankfurt), South America (Sao Paulo), and Asia Pacific (Singapore) AWS Regions and supports Application Load Balancer, Amazon API Gateway, and AWS AppSync resources.

13. Added S3LoggingBucketName to JSON. You need to specify the S3 Bucket where logs should be placed in. We also added a prefix for the logs to be AWS conform (Prefix: AWSLogs/AWS_ACCOUNTID/FirewallManager/AWS_REGION/).

14. Added testing your WAF with GoTestWAF. To be able to check your WAF we introduced the SecuredDomain parameter in the JSON (which should be your domain) which will be checked using the WAF tool.

15. TaskFileParameters:

    Parameter	Value
    SKIP_QUOTA_CHECK	true (Stop deployment if calculated WCU is above the quota) false (Skipping WCU Check)
    WAF_TEST	true (testing your waf with GoTestWAF) false (Skipping WAF testing)
    CREATE_DIAGRAM	true (generating a diagram using draw.io) false (Skipping diagram generation)
    CDK_DIFF	true (generating a cdk before invoking cdk deploy) false (Skipping cdk diff)

16. Validation of your ConfigFile using schema validation - if you miss a required parameter in your config file the deployment will stop automatically and show you the missing path.

17. PreProcess- and PostProcessRuleGroups - you can decide now where the Custom or ManagedRules should be added to.

    • New Structure see example json.

18. RuleLabels - A label is a string made up of a prefix, optional namespaces and a name. The components of a label are delimited with a colon. Labels have the following requirements and characteristics:

    • Labels are case-sensitive.

    • Each label namespace or label name can have up to 128 characters.

    • You can specify up to five namespaces in a label.

    • Components of a label are separated by a colon ( : ).

19. While Deployment the Price for your WAF will be calculated using the Pricing API

20. Dashboard - The Firewall Factory is able to provision a CloudWatch Dashboard per Firewall. The Dashboard shows:

    • Where the WAF is deployed to [AWS Region and Account(s)]
    • Which resource type you are securing
    • Which Managed Rule Groups in which version are in use
    • Link to Managed Rule Groups documentation
    • Direct Link to your secured Application / Endpoint
    • AWS Firewall Factory version
    • Check if the AWS Firewall Factory version is the latest or not during rollout
    • Allowed / Blocked and Counted Requests
    • Bot vs Non-bot Requests

See example:

🛡️ Deployment

Prerequisites

⚙️ Prerequisites

1. Organizations trusted access with Firewall Manager

2. Taskfile

3. AWS CDK

4. cfn-dia

5. Invoke npm i to install dependencies

6. ⚠️ Before installing a stack to your aws account using aws cdk you need to prepare the account using a cdk bootstrap

7. (Optional) If you want to use CloudWatch Dashboards - You need to enable your target accounts to share CloudWatch data with the central security account follow this to see how to do it.

8. Assume AWS Profile awsume PROFILENAME

9. (Optional) Enter task generateprerequisitesconfig

Parameter	Value
Prefix	Prefix for all Resources
BucketName 1	Name of the S3 Bucket
KmsEncryptionKey	true or false
ObjectLock - Days 1	A period of Days for ObjectLock
ObjectLock - Mode 1	COMPLIANCE or GOVERNANCE
FireHoseKey - KeyAlias 1	Alias for Key
CrossAccountIdforPermissions 1	Id of AWS Account for CrossAccount Permission for Bucket and KMS Key(s)

10. Enter task deploy config=NAMEOFYOURCONFIGFILE prerequisite=true

Deployment via Taskfile

🏁 Deployment via Taskfile

1. Create new json file for you WAF and configure Rules in the JSON (see owasptopten.json to see structure)
2. Assume AWS Profile awsume PROFILENAME
3. (Optional) Enter task generateconfig
4. Enter task deploy config=NAMEOFYOURCONFIGFILE

🦸🏼‍♀️ Contributors

Any form of contribution is welcome. The above contributors have been officially released by globaldatanet.

👩‍💻 Contribute

Want to contribute to AWS FIREWALL FACTORY? Check out the Contribution docs

👏 Supporters

Footnotes

1. Optional Fields. ↩ ↩² ↩³ ↩⁴ ↩⁵