A web application firewall (WAF) protects your internet-facing applications from common web exploits that could affect their availability, compromise their security, or consume excessive resources. It works by filtering and monitoring HTTP traffic based on a set of rules.

You can use a WAF to:

• Block malicious traffic using managed rule groups that are curated by security experts.
• Create your own custom rules to address specific threats.
• Implement rate-based rules to prevent your resources from being overloaded by excessive requests.

You can use a WAF with the following Stacktape resources:

• Application Load Balancers
• Web Services
• User Pools
• Content Delivery Networks (CDNs)

Usage

With a web service (ALB)

resources:
  myFirewall:
    type: web-app-firewall
    properties:
      scope: regional
  webService:
    type: web-service
    properties:
      loadBalancing:
        type: application-load-balancer
      useFirewall: myFirewall
      packaging:
        type: stacktape-image-buildpack
        properties:
          entryfilePath: ./src/index.ts
      resources:
        cpu: 0.25
        memory: 512

With a web service (API GW + CDN)

resources:
  myFirewall:
    type: web-app-firewall
    properties:
      scope: regional
  webService:
    type: web-service
    properties:
      cdn:
        enabled: true
        useFirewall: myFirewall
      packaging:
        type: stacktape-image-buildpack
        properties:
          entryfilePath: ./src/index.ts
      resources:
        cpu: 0.25
        memory: 512

With an application load balancer

resources:
  myFirewall:
    type: web-app-firewall
    properties:
      scope: regional
  applicationLoadBalancer:
    type: application-load-balancer
    properties:
      useFirewall: myFirewall

With a user pool

resources:
  myFirewall:
    type: web-app-firewall
    properties:
      scope: regional
  userPool:
    type: user-auth-pool
    properties:
      userVerificationType: email-code
      passwordPolicy:
        minimumLength: 8
      useFirewall: myFirewall

With a Lambda (Lambda URL +CDN)

resources:
  myFirewall:
    type: web-app-firewall
    properties:
      scope: regional
  lambda:
    type: function
    properties:
      packaging:
        type: stacktape-lambda-buildpack
        properties:
          entryfilePath: ./src/index.ts
      url:
        enabled: true
      cdn:
        enabled: true
        useFirewall: myFirewall

Scope

The scope determines whether the WAF is used with regional resources or with a CDN.

Rules

All requests to resources protected by the WAF are evaluated against a set of rules.

Default rules

If you don't specify any rules, Stacktape applies a default set of managed rules from AWS that protect against common attacks, including those listed in the OWASP Top 10. These rules protect against vulnerabilities like SQL injection and cross-site scripting (XSS).

Specifically, it uses the following rule groups:

• Common rule set (AWSManagedRulesCommonRuleSet): Protects against a wide range of common vulnerabilities.
• Known bad inputs (AWSManagedRulesKnownBadInputsRuleSet): Blocks request patterns that are known to be malicious.

You can find more information about these rule groups in the AWS documentation.

Managed rule groups

Managed rule groups are sets of rules maintained by AWS or third-party vendors. They are regularly updated to protect against the latest threats.

While rule groups managed by AWS are typically free, some third-party vendors may charge for their rule groups.

resources:
  regionalFirewall:
    type: web-app-firewall
    properties:
      scope: regional
      rules:
        - type: managed-rule-group
          properties:
            name: AWSManagedRulesCommonRuleSet
            vendorName: AWS
            priority: 0

Custom rule groups

You can create your own custom rule groups to use across multiple applications. To use an existing custom rule group, you just need to provide its ARN.

resources:
  regionalFirewall:
    type: web-app-firewall
    properties:
      scope: regional
      rules:
        - type: custom-rule-group
          properties:
            name: CustomRuleGroup
            arn: <<ARN of existing rule group>>
            priority: 0

Rate-based rules

Rate-based rules track the number of requests from each originating IP address and trigger an action if the rate exceeds a specified limit within a five-minute period. This is useful for temporarily blocking IP addresses that are sending excessive requests.

You can aggregate requests based on the client's IP address or a forwarded IP address from a proxy or load balancer.

resources:
  regionalFirewall:
    type: web-app-firewall
    properties:
      scope: regional
      rules:
        - type: rate-based-rule
          properties:
            name: RateRule
            limit: 100
            aggregateBasedOn: IP
            priority: 0

Monitoring

You can monitor your firewall and its rules using Amazon CloudWatch and the AWS WAF console. By default, metrics and sampled requests are enabled for the firewall as a whole but disabled for individual rules. You can change this behavior using the metricsEnabled and sampledRequestsEnabled properties.

Stacktape will automatically create links to the AWS WAF console and the CloudWatch metrics dashboard in the Stacktape Console.

For more details, see the AWS documentation on metrics and sampled requests.

Pricing

You are charged for:

• Firewall (WebACL): $5.00 per month.
• Rules: $1.00 per rule per month.
• Requests: $0.60 per million requests.

Additional costs may apply for paid managed rule groups from third-party vendors.

For example, a firewall with the default rules will cost $7.00 per month ($5.00 for the firewall and $2.00 for the two default rule groups), plus $0.60 for every million requests.

To learn more, see the AWS WAF pricing page.

Referenceable parameters

API reference