-
Notifications
You must be signed in to change notification settings - Fork 361
/
aws-waf-security-automations.template
2795 lines (2613 loc) · 115 KB
/
aws-waf-security-automations.template
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
AWSTemplateFormatVersion: 2010-09-09
Description: >-
(SO0006) - Security Automations for AWS WAF: This AWS CloudFormation template helps
you provision the Security Automations for AWS WAF stack without worrying about creating and
configuring the underlying AWS infrastructure.
**WARNING** This template creates multiple AWS Lambda functions, an AWS WAFv2 Web ACL, an Amazon S3 bucket,
and an Amazon CloudWatch custom metric. You will be billed for the AWS resources used if you
create a stack from this template. %VERSION%
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Resource Type
Parameters:
- EndpointType
- Label:
default: AWS Managed IP Reputation Rule Groups
Parameters:
- ActivateAWSManagedIPRParam
- ActivateAWSManagedAIPParam
- Label:
default: AWS Managed Baseline Rule Groups
Parameters:
- ActivateAWSManagedRulesParam
- ActivateAWSManagedAPParam
- ActivateAWSManagedKBIParam
- Label:
default: AWS Managed Use-case Specific Rule Groups
Parameters:
- ActivateAWSManagedSQLParam
- ActivateAWSManagedLinuxParam
- ActivateAWSManagedPOSIXParam
- ActivateAWSManagedWindowsParam
- ActivateAWSManagedPHPParam
- ActivateAWSManagedWPParam
- Label:
default: Custom Rule - Scanner & Probes
Parameters:
- ActivateScannersProbesProtectionParam
- AppAccessLogBucket
- AppAccessLogBucketPrefixParam
- AppAccessLogBucketLoggingStatusParam
- ErrorThreshold
- KeepDataInOriginalS3Location
- Label:
default: Custom Rule - HTTP Flood
Parameters:
- ActivateHttpFloodProtectionParam
- RequestThreshold
- RequestThresholdByCountryParam
- HTTPFloodAthenaQueryGroupByParam
- WAFBlockPeriod
- AthenaQueryRunTimeScheduleParam
- Label:
default: Custom Rule - Bad Bot
Parameters:
- ActivateBadBotProtectionParam
- ApiGatewayBadBotCWRoleParam
- Label:
default: Custom Rule - Third Party IP Reputation Lists
Parameters:
- ActivateReputationListsProtectionParam
- Label:
default: Legacy Custom Rules
Parameters:
- ActivateSqlInjectionProtectionParam
- SqlInjectionProtectionSensitivityLevelParam
- ActivateCrossSiteScriptingProtectionParam
- Label:
default: Allowed and Denied IP Retention Settings
Parameters:
- IPRetentionPeriodAllowedParam
- IPRetentionPeriodDeniedParam
- SNSEmailParam
- Label:
default: Advanced Settings
Parameters:
- LogGroupRetentionParam
ParameterLabels:
ActivateAWSManagedRulesParam:
default: Activate Core Rule Set Managed Rule Group Protection
ActivateAWSManagedAPParam:
default: Activate Admin Protection Managed Rule Group Protection
ActivateAWSManagedKBIParam:
default: Activate Known Bad Inputs Managed Rule Group Protection
ActivateAWSManagedIPRParam:
default: Activate Amazon IP reputation List Managed Rule Group Protection
ActivateAWSManagedAIPParam:
default: Activate Anonymous IP List Managed Rule Group Protection
ActivateAWSManagedSQLParam:
default: Activate SQL Database Managed Rule Group Protection
ActivateAWSManagedLinuxParam:
default: Activate Linux Operating System Managed Rule Group Protection
ActivateAWSManagedPOSIXParam:
default: Activate POSIX Operating System Managed Rule Group Protection
ActivateAWSManagedWindowsParam:
default: Activate Windows Operating System Managed Rule Group Protection
ActivateAWSManagedPHPParam:
default: Activate PHP Application Managed Rule Group Protection
ActivateAWSManagedWPParam:
default: Activate WordPress Application Managed Rule Group Protection
ActivateSqlInjectionProtectionParam:
default: Activate SQL Injection Protection
SqlInjectionProtectionSensitivityLevelParam:
default: Sensitivity Level for SQL Injection Protection
ActivateCrossSiteScriptingProtectionParam:
default: Activate Cross-site Scripting Protection
ActivateHttpFloodProtectionParam:
default: Activate HTTP Flood Protection
ActivateScannersProbesProtectionParam:
default: Activate Scanner & Probe Protection
ActivateReputationListsProtectionParam:
default: Activate Reputation List Protection
ActivateBadBotProtectionParam:
default: Activate Bad Bot Protection
ApiGatewayBadBotCWRoleParam:
default: ARN of an IAM role that has write access to CloudWatch logs in your account
EndpointType:
default: Endpoint
AppAccessLogBucket:
default: Application Access Log Bucket Name
AppAccessLogBucketPrefixParam:
default: Application Access Log Bucket Prefix
AppAccessLogBucketLoggingStatusParam:
default: Is bucket access logging turned on?
ErrorThreshold:
default: Error Threshold
RequestThreshold:
default: Default Request Threshold
RequestThresholdByCountryParam:
default: Request Threshold by Country
HTTPFloodAthenaQueryGroupByParam:
default: Group By Requests in HTTP Flood Athena Query
WAFBlockPeriod:
default: WAF Block Period
AthenaQueryRunTimeScheduleParam:
default: Athena Query Run Time Schedule (Minute)
KeepDataInOriginalS3Location:
default: Keep Data in Original S3 Location
IPRetentionPeriodAllowedParam:
default: Retention Period (Minutes) for Allowed IP Set
IPRetentionPeriodDeniedParam:
default: Retention Period (Minutes) for Denied IP Set
SNSEmailParam:
default: Email for receiving notification upon Allowed or Denied IP Sets expiration
LogGroupRetentionParam:
default: Retention Period (Days) for Log Groups
Parameters:
ActivateAWSManagedRulesParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
Core Rule Set provides protection against exploitation of a wide range of vulnerabilities,
including some of the high risk and commonly occurring vulnerabilities. Consider using
this rule group for any AWS WAF use case. Required WCU: 700. Your account should have
sufficient WCU capacity to avoid WebACL stack deployment failure due to exceeding the
capacity limit.
ActivateAWSManagedAPParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Admin protection rule group blocks external access to exposed administrative pages.
This might be useful if you run third-party software or want to reduce the risk of a
malicious actor gaining administrative access to your application. Required WCU: 100.
ActivateAWSManagedKBIParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Known bad inputs rule group blocks request patterns that are known to be invalid and
are associated with exploitation or discovery of vulnerabilities. This can help reduce
the risk of a malicious actor discovering a vulnerable application. Required WCU: 200.
ActivateAWSManagedIPRParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Amazon IP reputation list rule group are based on Amazon internal threat intelligence.
This is useful if you would like to block IP addresses typically associated with bots or
other threats. Blocking these IP addresses can help mitigate bots and reduce the risk of
a malicious actor discovering a vulnerable application. Required WCU: 25.
ActivateAWSManagedAIPParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Anonymous IP list rule group blocks requests from services that permit the obfuscation of
viewer identity. These include requests from VPNs, proxies, Tor nodes, and hosting providers.
This rule group is useful if you want to filter out viewers that might be trying to hide their
identity from your application. Blocking the IP addresses of these services can help mitigate
bots and evasion of geographic restrictions. Required WCU: 50.
ActivateAWSManagedSQLParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The SQL database rule group blocks request patterns associated with exploitation of SQL databases,
like SQL injection attacks. This can help prevent remote injection of unauthorized queries. Evaluate
this rule group for use if your application interfaces with an SQL database. Using the SQL injection
custom rule is optional, if you already have AWS managed SQL rule group activated. Required WCU: 200.
ActivateAWSManagedLinuxParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Linux operating system rule group blocks request patterns associated with the exploitation of
vulnerabilities specific to Linux, including Linux-specific Local File Inclusion (LFI) attacks.
This can help prevent attacks that expose file contents or run code for which the attacker should
not have had access. Evaluate this rule group if any part of your application runs on Linux. You
should use this rule group in conjunction with the POSIX operating system rule group. Required WCU: 200.
ActivateAWSManagedPOSIXParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The POSIX operating system rule group blocks request patterns associated with the exploitation of
vulnerabilities specific to POSIX and POSIX-like operating systems, including Local File Inclusion
(LFI) attacks. This can help prevent attacks that expose file contents or run code for which the
attacker should not have had access. Evaluate this rule group if any part of your application runs
on a POSIX or POSIX-like operating system. Required WCU: 100.
ActivateAWSManagedWindowsParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The Windows operating system rule group blocks request patterns associated with the exploitation of
vulnerabilities specific to Windows, like remote execution of PowerShell commands. This can help
prevent exploitation of vulnerabilities that permit an attacker to run unauthorized commands or run
malicious code. Evaluate this rule group if any part of your application runs on a Windows operating
system. Required WCU: 200.
ActivateAWSManagedPHPParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The PHP application rule group blocks request patterns associated with the exploitation of vulnerabilities
specific to the use of the PHP programming language, including injection of unsafe PHP functions. This can
help prevent exploitation of vulnerabilities that permit an attacker to remotely run code or commands for
which they are not authorized. Evaluate this rule group if PHP is installed on any server with which your
application interfaces. Required WCU: 100.
ActivateAWSManagedWPParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
The WordPress application rule group blocks request patterns associated with the exploitation of vulnerabilities
specific to WordPress sites. Evaluate this rule group if you are running WordPress. This rule group should be
used in conjunction with the SQL database and PHP application rule groups. Required WCU: 100.
ActivateSqlInjectionProtectionParam:
Type: String
Default: 'yes'
AllowedValues:
- 'yes'
- 'yes - MATCH'
- 'yes - NO_MATCH'
- 'no'
Description: >-
Choose yes to deploy the default SQL injection protection rule designed to block common SQL injection attacks.
Consider activating it if you are not using Core Rule Set or AWS managed SQL database rule group. The 'yes'
option uses CONTINUE for oversized request handling by default. Note: If you customized the rule outside of
CloudFormation, your changes will be overwritten after stack update.
SqlInjectionProtectionSensitivityLevelParam:
Type: String
Default: 'LOW'
AllowedValues:
- 'LOW'
- 'HIGH'
Description: >-
Choose the sensitivity level used by WAF to inspect for SQL injection attacks.
If you choose to deactivate SQL injection protection, ignore this parameter.
Note: The stack deploys the default SQL injection protection rule into your AWS account.
If you customized the rule outside of CloudFormation, your changes will be overwritten after stack update.
ActivateCrossSiteScriptingProtectionParam:
Type: String
Default: 'yes'
AllowedValues:
- 'yes'
- 'yes - MATCH'
- 'yes - NO_MATCH'
- 'no'
Description: >-
Choose yes to deploy the default cross-site scripting protection rule designed to block common cross-site scripting attacks.
Consider activating it if you are not using Core Rule Set. The 'yes' option uses CONTINUE for oversized request handling by
default. Note: If you customized the rule outside of CloudFormation, your changes will be overwritten after stack update.
ActivateHttpFloodProtectionParam:
Type: String
Default: 'yes - AWS WAF rate based rule'
AllowedValues:
- 'yes - AWS WAF rate based rule'
- 'yes - AWS Lambda log parser'
- 'yes - Amazon Athena log parser'
- 'no'
Description: Choose yes to activate the component designed to block HTTP flood attacks.
ActivateScannersProbesProtectionParam:
Type: String
Default: 'yes - AWS Lambda log parser'
AllowedValues:
- 'yes - AWS Lambda log parser'
- 'yes - Amazon Athena log parser'
- 'no'
Description: Choose yes to activate the component designed to block scanners and probes.
ActivateReputationListsProtectionParam:
Type: String
Default: 'yes'
AllowedValues:
- 'yes'
- 'no'
Description: >-
Choose yes to block requests from IP addresses on third-party reputation lists (supported
lists: spamhaus, torproject, and emergingthreats).
ActivateBadBotProtectionParam:
Type: String
Default: 'yes'
AllowedValues:
- 'yes'
- 'no'
Description: Choose yes to activate the component designed to block bad bots and content scrapers.
ApiGatewayBadBotCWRoleParam:
Type: String
Default: ''
Description: >-
Provide an optional ARN of an IAM role that has write access to CloudWatch logs in your
account. Example ARN: arn:aws:iam::account_id:role/myrolename.
See https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html
for instructions on how to create the role. If you leave it blank (default), a new role
will be created for you.
EndpointType:
Type: String
Default: 'CloudFront'
AllowedValues:
- 'CloudFront'
- 'ALB'
Description: Select the resource type and then select the resource below that you want to associate with this web ACL.
AppAccessLogBucket:
Type: String
Default: ''
AllowedPattern: '(^$|^([a-z]|(\d(?!\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3})))([a-z\d]|(\.(?!(\.|-)))|(-(?!\.))){1,61}[a-z\d]$)'
Description: >-
If you chose yes for the Activate Scanners & Probes Protection parameter, enter a name for the
Amazon S3 bucket (new or existing) where you want to store access logs for your CloudFront
distribution or Application Load Balancer. More about bucket name restriction here:
http://amzn.to/1p1YlU5. If you chose to deactivate this protection, ignore this parameter.
AppAccessLogBucketPrefixParam:
Type: String
Default: 'AWSLogs/'
Description: >-
If you chose yes for the Activate Scanners & Probes Protection parameter, you can enter
an optional user defined prefix for the application access logs bucket above. For ALB resource,
you must append AWSLogs/ to your prefix such as yourprefix/AWSLogs/. For CloudFront resource,
you can enter any prefix such as yourprefix/. Leave it to AWSLogs/ (default) if there isn't a
user-defined prefix. If you chose to deactivate this protection, ignore this parameter.
AppAccessLogBucketLoggingStatusParam:
Type: String
Default: 'no'
AllowedValues:
- 'yes'
- 'no'
Description: >-
Choose yes if you provided an existing application access log bucket above and the server access
logging for the bucket is already turned on. If you chose no, the solution will turn on server
access logging for your bucket. If you deactivate Scanners & Probes Protection, ignore this
parameter.
ErrorThreshold:
Type: Number
Default: 50
MinValue: 0
Description: >-
If you chose yes for the Activate Scanners & Probes Protection parameter, enter the maximum
acceptable bad requests per minute per IP. If you chose to deactivate this protection
protection, ignore this parameter.
RequestThreshold:
Type: Number
Default: 100
MinValue: 0
Description: >-
If you chose yes for the Activate HTTP Flood Protection parameter, enter the maximum
acceptable requests per IP address per FIVE-minute period (default). You can change
the time period by entering a different number for Athena Query Run Time Schedule below.
The request threshold is divided by this number to get the desired threshold per
minute that is used in Athena query. Note: AWS WAF rate based rule requires a value
greater than 100 (if you chose Lambda/Athena log parser options, you can use any value
greater than zero). If you chose to deactivate this protection, ignore this parameter.
RequestThresholdByCountryParam:
Type: String
Default: ''
AllowedPattern: '^$|^\{"\w+":\d+([,]"\w+":\d+)*\}+$'
Description: >-
If you chose Athena Log Parser to activate HTTP Flood Protection, you can enter a threshold
by country following this JSON format {"TR":50,"ER":150}. These thresholds will be used for
the requests originated from the specified countries, while the default threshold above
will be used for the remaining requests. The threshold is calculated in a default FIVE-minute
period. You can change the time period by entering a different number for Athena Query Run Time
Schedule below. The request threshold is divided by this number to get the desired threshold
per minute that is used in Athena query. Note: If you define a threshold by country, country
will automatically be included in Athena query group-by clause, along with ip and other group-by
fields you may select below. If you chose to deactivate this protection, ignore this parameter.
HTTPFloodAthenaQueryGroupByParam:
Type: String
Default: 'None'
AllowedValues:
- 'Country'
- 'URI'
- 'Country and URI'
- 'None'
Description: >-
If you chose Athena Log Parser to activate HTTP Flood Protection, you can select a group-by field
to count requests per IP along with the selected group-by field. For example, if URI is selected,
the requests will be counted per IP and URI. If you chose to deactivate this protection,
ignore this parameter.
WAFBlockPeriod:
Type: Number
Default: 240
MinValue: 0
Description: >-
If you chose yes for the Activate Scanners & Probes Protection or HTTP Flood Lambda/Athena log
parser parameters, enter the period (in minutes) to block applicable IP addresses. If you
chose to deactivate log parsing, ignore this parameter.
AthenaQueryRunTimeScheduleParam:
Type: Number
Default: 5
MinValue: 1
Description: >-
If you chose Athena Log Parser to activate Scanners & Probes Protection or HTTP Flood Protection,
you can enter a time interval (in minutes) over which the Athena query runs. By default, the Athena
query runs every 5 minutes. Request threshold entered above is divided by this number to get the
threshold per minute in the Athena query. If you chose to deactivate these protections, ignore this
parameter.
KeepDataInOriginalS3Location:
Type: String
Default: 'No'
AllowedValues:
- 'Yes'
- 'No'
Description: >-
If you chose Amazon Athena log parser for the Activate Scanners & Probes Protection parameter,
partitioning will be applied to log files and Athena queries. By default log files will be moved
from their original location to a partitioned folder structure in s3. Choose Yes if you also want
to keep a copy of the logs in their original location. Selecting "Yes" will duplicate your log
storage. If you did not choose to activate Athena log parsing, ignore this parameter.
IPRetentionPeriodAllowedParam:
Type: Number
Default: -1
MinValue: -1
Description: >-
If you want to activate IP retention for the Allowed IP set, enter a number (15 or above) as the retention period (minutes).
IP addresses reaching the retention period will expire and be removed from the IP set. A minimum 15-minute retention
period is supported. If you enter a number between 0 and 15, it will be treated as 15. Leave it to default value -1
to disable IP retention.
IPRetentionPeriodDeniedParam:
Type: Number
Default: -1
MinValue: -1
Description: >-
If you want to activate IP retention for the Denied IP set, enter a number (15 or above) as the retention period (minutes).
IP addresses reaching the retention period will expire and be removed from the IP set. A minimum 15-minute retention
period is supported. If you enter a number between 0 and 15, it will be treated as 15. Leave it to default value -1
to disable IP retention.
SNSEmailParam:
Type: String
Default: ''
Description: >-
If you activated IP retention period above and want to receive an email notification when IP addresses expire, enter a valid email address.
If you did not activate IP retention or want to disable email notification, leave it blank (default).
LogGroupRetentionParam:
Type: Number
Default: 365
AllowedValues:
- -1
- 1
- 3
- 5
- 7
- 14
- 30
- 60
- 90
- 120
- 150
- 180
- 365
- 400
- 545
- 731
- 1827
- 2192
- 2557
- 2922
- 3288
- 3653
Description: >-
If you want to activate retention for the CloudWatch Log Groups, enter a number (1 or above) as the retention period (days).
You can choose a retention period between one day and 10 years. By default logs will expired after 1 year. Set it to -1 to
keep the logs indefinitely.
Conditions:
HttpFloodProtectionRateBasedRuleActivated: !Equals
- !Ref ActivateHttpFloodProtectionParam
- 'yes - AWS WAF rate based rule'
HttpFloodLambdaLogParser: !Equals
- !Ref ActivateHttpFloodProtectionParam
- 'yes - AWS Lambda log parser'
HttpFloodAthenaLogParser: !Equals
- !Ref ActivateHttpFloodProtectionParam
- 'yes - Amazon Athena log parser'
HttpFloodProtectionLogParserActivated: !Or
- Condition: HttpFloodLambdaLogParser
- Condition: HttpFloodAthenaLogParser
ScannersProbesLambdaLogParser: !Equals
- !Ref ActivateScannersProbesProtectionParam
- 'yes - AWS Lambda log parser'
ScannersProbesAthenaLogParser: !Equals
- !Ref ActivateScannersProbesProtectionParam
- 'yes - Amazon Athena log parser'
ScannersProbesProtectionActivated: !Or
- Condition: ScannersProbesLambdaLogParser
- Condition: ScannersProbesAthenaLogParser
AthenaLogParser: !Or
- Condition: HttpFloodAthenaLogParser
- Condition: ScannersProbesAthenaLogParser
LogParser: !Or
- Condition: HttpFloodProtectionLogParserActivated
- Condition: ScannersProbesProtectionActivated
CreateFirehoseAthenaStack: !Or
- Condition: HttpFloodProtectionLogParserActivated
- Condition: AthenaLogParser
ReputationListsProtectionActivated: !Equals
- !Ref ActivateReputationListsProtectionParam
- 'yes'
BadBotProtectionActivated: !Equals
- !Ref ActivateBadBotProtectionParam
- 'yes'
ApiGatewayBadBotCWRoleNotExists: !Equals [!Ref ApiGatewayBadBotCWRoleParam, '']
CreateApiGatewayBadBotCloudWatchRole: !And
- Condition: BadBotProtectionActivated
- Condition: ApiGatewayBadBotCWRoleNotExists
AlbEndpoint: !Equals
- !Ref EndpointType
- 'ALB'
CustomResourceLambdaAccess: !Or
- Condition: ReputationListsProtectionActivated
- Condition: AthenaLogParser
IPRetentionAllwedPeriod: !Not [!Equals [!Ref IPRetentionPeriodAllowedParam, -1]]
IPRetentionDeniedPeriod: !Not [!Equals [!Ref IPRetentionPeriodDeniedParam, -1]]
IPRetentionPeriod: !Or
- Condition: IPRetentionAllwedPeriod
- Condition: IPRetentionDeniedPeriod
SNSEmailProvided: !Not [!Equals [!Ref SNSEmailParam, '']]
SNSEmail: !And
- Condition: IPRetentionPeriod
- Condition: SNSEmailProvided
AppAccessLogBucketLoggingOff: !Equals
- !Ref AppAccessLogBucketLoggingStatusParam
- 'no'
TurnOnAppAccessLogBucketLogging: !And
- Condition: ScannersProbesProtectionActivated
- Condition: AppAccessLogBucketLoggingOff
CreateS3LoggingBucket: !Or
- Condition: HttpFloodProtectionLogParserActivated
- Condition: TurnOnAppAccessLogBucketLogging
UserDefinedAppAccessLogBucketPrefix: !Not [!Equals [!Ref AppAccessLogBucketPrefixParam, 'AWSLogs/']]
RequestThresholdByCountry: !Not [!Equals [!Ref RequestThresholdByCountryParam, '']]
IsAthenaQueryRunEveryMinute: !Equals [!Ref AthenaQueryRunTimeScheduleParam, 1]
LogGroupRetentionEnabled: !Not [!Equals [!Ref LogGroupRetentionParam, -1]]
Mappings:
SourceCode:
General:
TemplateBucket: '%TEMPLATE_OUTPUT_BUCKET%'
SourceBucket: '%DIST_OUTPUT_BUCKET%'
KeyPrefix: '%SOLUTION_NAME%/%VERSION%'
Solution:
Data:
SendAnonymizedUsageData: 'Yes'
LogLevel: 'INFO'
SolutionID: 'SO0006'
MetricsURL: 'https://metrics.awssolutionsbuilder.com/generic'
Action:
WAFWhitelistRule: 'ALLOW'
WAFBlacklistRule: 'BLOCK'
WAFSqlInjectionRule: 'BLOCK'
WAFXssRule: 'BLOCK'
WAFHttpFloodRateBasedRule: 'BLOCK'
WAFHttpFloodRegularRule: 'BLOCK'
WAFScannersProbesRule: 'BLOCK'
WAFIPReputationListsRule: 'BLOCK'
WAFBadBotRule: 'BLOCK'
UserAgent:
UserAgentExtra: 'AwsSolution/SO0006/%VERSION%'
AppRegistry:
AppRegistryApplicationName: 'waf-security-automations'
SolutionName: 'WAF Security Automations'
Resources:
CheckRequirements:
Type: 'Custom::CheckRequirements'
Properties:
AthenaLogParser: !If [AthenaLogParser, 'yes', 'no']
ServiceToken: !GetAtt Helper.Arn
HttpFloodProtectionRateBasedRuleActivated: !If [HttpFloodProtectionRateBasedRuleActivated, 'yes', 'no']
HttpFloodProtectionLogParserActivated: !If [HttpFloodProtectionLogParserActivated, 'yes', 'no']
ProtectionActivatedScannersProbes: !If [ScannersProbesProtectionActivated, 'yes', 'no']
AppAccessLogBucket: !Ref AppAccessLogBucket
Region: !Ref 'AWS::Region'
EndpointType: !Ref EndpointType
RequestThreshold: !Ref RequestThreshold
FirehoseAthenaStack:
Type: 'AWS::CloudFormation::Stack'
Condition: CreateFirehoseAthenaStack
DependsOn: CheckRequirements
Properties:
TemplateURL: !Sub
- 'https://${S3Bucket}.s3.amazonaws.com/${KeyPrefix}/aws-waf-security-automations-firehose-athena.template'
-
S3Bucket: !FindInMap ["SourceCode", "General", "TemplateBucket"]
KeyPrefix: !FindInMap ["SourceCode", "General", "KeyPrefix"]
Parameters:
ActivateHttpFloodProtectionParam: !Ref ActivateHttpFloodProtectionParam
ActivateScannersProbesProtectionParam: !Ref ActivateScannersProbesProtectionParam
EndpointType: !Ref EndpointType
AppAccessLogBucket: !Ref AppAccessLogBucket
ParentStackName: !Ref 'AWS::StackName'
WafLogBucket: !If [HttpFloodProtectionLogParserActivated, !Ref WafLogBucket, '']
WafLogBucketArn: !If [HttpFloodProtectionLogParserActivated, !GetAtt WafLogBucket.Arn, '']
ErrorThreshold: !Ref ErrorThreshold
RequestThreshold: !Ref RequestThreshold
WAFBlockPeriod: !Ref WAFBlockPeriod
GlueDatabaseName: !If [AthenaLogParser, !GetAtt CreateGlueDatabaseName.DatabaseName, '']
DeliveryStreamName: !If [HttpFloodProtectionLogParserActivated, !GetAtt CreateDeliveryStreamName.DeliveryStreamName, '']
UUID: !GetAtt CreateUniqueID.UUID
WebACLStack:
Type: 'AWS::CloudFormation::Stack'
DependsOn: CheckRequirements
Properties:
TemplateURL: !Sub
- 'https://${S3Bucket}.s3.amazonaws.com/${KeyPrefix}/aws-waf-security-automations-webacl.template'
-
S3Bucket: !FindInMap ["SourceCode", "General", "TemplateBucket"]
KeyPrefix: !FindInMap ["SourceCode", "General", "KeyPrefix"]
Parameters:
ActivateAWSManagedRulesParam: !Ref ActivateAWSManagedRulesParam
ActivateAWSManagedAPParam: !Ref ActivateAWSManagedAPParam
ActivateAWSManagedKBIParam: !Ref ActivateAWSManagedKBIParam
ActivateAWSManagedIPRParam: !Ref ActivateAWSManagedIPRParam
ActivateAWSManagedAIPParam: !Ref ActivateAWSManagedAIPParam
ActivateAWSManagedSQLParam: !Ref ActivateAWSManagedSQLParam
ActivateAWSManagedLinuxParam: !Ref ActivateAWSManagedLinuxParam
ActivateAWSManagedPOSIXParam: !Ref ActivateAWSManagedPOSIXParam
ActivateAWSManagedWindowsParam: !Ref ActivateAWSManagedWindowsParam
ActivateAWSManagedPHPParam: !Ref ActivateAWSManagedPHPParam
ActivateAWSManagedWPParam: !Ref ActivateAWSManagedWPParam
ActivateSqlInjectionProtectionParam: !Ref ActivateSqlInjectionProtectionParam
ActivateCrossSiteScriptingProtectionParam: !Ref ActivateCrossSiteScriptingProtectionParam
SqlInjectionProtectionSensitivityLevelParam: !Ref SqlInjectionProtectionSensitivityLevelParam
ActivateHttpFloodProtectionParam: !Ref ActivateHttpFloodProtectionParam
ActivateScannersProbesProtectionParam: !Ref ActivateScannersProbesProtectionParam
ActivateReputationListsProtectionParam: !Ref ActivateReputationListsProtectionParam
ActivateBadBotProtectionParam: !Ref ActivateBadBotProtectionParam
RequestThreshold: !Ref RequestThreshold
RegionScope: !If [AlbEndpoint, 'REGIONAL', 'CLOUDFRONT']
ParentStackName: !Ref 'AWS::StackName'
GlueAccessLogsDatabase: !If [AthenaLogParser, !GetAtt FirehoseAthenaStack.Outputs.GlueAccessLogsDatabase, '']
GlueAppAccessLogsTable: !If [ScannersProbesAthenaLogParser, !GetAtt FirehoseAthenaStack.Outputs.GlueAppAccessLogsTable, '']
GlueWafAccessLogsTable: !If [HttpFloodAthenaLogParser, !GetAtt FirehoseAthenaStack.Outputs.GlueWafAccessLogsTable,'']
LogLevel: !FindInMap ["Solution", "Data", "LogLevel"]
LambdaRoleHelper:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- 'sts:AssumeRole'
Path: /
Policies:
- PolicyName: S3Access
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- 's3:GetBucketLocation'
- 's3:GetObject'
- 's3:ListBucket'
Resource:
- !Sub 'arn:${AWS::Partition}:s3:::${AppAccessLogBucket}'
- PolicyName: WAFAccess
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'wafv2:ListWebACLs'
Resource:
- !Sub 'arn:${AWS::Partition}:wafv2:${AWS::Region}:${AWS::AccountId}:regional/webacl/*'
- !Sub 'arn:${AWS::Partition}:wafv2:${AWS::Region}:${AWS::AccountId}:global/webacl/*'
- PolicyName: LogsAccess
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource:
- !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*Helper*'
Metadata:
cfn_nag:
rules_to_suppress:
-
id: W11
reason: "LogsAccess permission restricted to account, region and log group name substring (Helper)."
-
id: W76
reason: "The policy is long as it is scoped down to all the IP set ARNs and function ARNs."
LambdaRoleBadBot:
Type: 'AWS::IAM::Role'
Condition: BadBotProtectionActivated
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- 'sts:AssumeRole'
Path: /
Policies:
- PolicyName: LogsAccess
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource:
- !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*BadBotParser*'
- PolicyName: 'CloudFormationAccess'
PolicyDocument:
Statement:
- Effect: Allow
Action: 'cloudformation:DescribeStacks'
Resource:
- !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*'
- PolicyName: WAFGetAndUpdateIPSet
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'wafv2:GetIPSet'
- 'wafv2:UpdateIPSet'
Resource:
- !GetAtt WebACLStack.Outputs.WAFBadBotSetV4Arn
- !GetAtt WebACLStack.Outputs.WAFBadBotSetV6Arn
- PolicyName: CloudWatchAccess
PolicyDocument:
Statement:
- Effect: Allow
Action: 'cloudwatch:GetMetricStatistics'
Resource:
- '*'
Metadata:
cfn_nag:
rules_to_suppress:
-
id: W11
reason: >-
LogsAccess - permission restricted to account, region and log group name substring (BadBotParser);
CloudFormationAccess - account, region and stack name;
CloudWatchAccess - this actions does not support resource-level permissions
LambdaRoleReputationListsParser:
Type: 'AWS::IAM::Role'
Condition: ReputationListsProtectionActivated
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action: 'sts:AssumeRole'
Policies:
- PolicyName: CloudWatchLogs
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource:
- !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*ReputationListsParser*'
- PolicyName: WAFGetAndUpdateIPSet
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'wafv2:GetIPSet'
- 'wafv2:UpdateIPSet'
Resource:
- !GetAtt WebACLStack.Outputs.WAFReputationListsSetV4Arn
- !GetAtt WebACLStack.Outputs.WAFReputationListsSetV6Arn
- PolicyName: CloudFormationAccess
PolicyDocument:
Statement:
- Effect: Allow
Action: 'cloudformation:DescribeStacks'
Resource:
- !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*'
- PolicyName: CloudWatchAccess
PolicyDocument:
Statement:
- Effect: Allow
Action: 'cloudwatch:GetMetricStatistics'
Resource:
- '*'
Metadata:
cfn_nag:
rules_to_suppress:
-
id: W11
reason: >-
CloudWatchLogs - permission restricted to account, region and log group name substring (ReputationListsParser);
CloudFormationAccess - account, region and stack name;
CloudWatchAccess - this actions does not support resource-level permissions
LambdaRoleLogParser:
Type: 'AWS::IAM::Role'
Condition: LogParser
DependsOn: WebACLStack
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: '/'
Policies:
- !If
- ScannersProbesProtectionActivated
- PolicyName: ScannersProbesProtectionActivatedAccess
PolicyDocument:
Statement:
# S3 Resources
- Effect: Allow
Action: 's3:GetObject'
Resource:
- !Sub 'arn:${AWS::Partition}:s3:::${AppAccessLogBucket}/*'
- Effect: Allow
Action: 's3:PutObject'
Resource:
- !Sub 'arn:${AWS::Partition}:s3:::${AppAccessLogBucket}/${AWS::StackName}-app_log_out.json'
- !Sub 'arn:${AWS::Partition}:s3:::${AppAccessLogBucket}/${AWS::StackName}-app_log_conf.json'
- Effect: Allow
Action:
- 'wafv2:GetIPSet'
- 'wafv2:UpdateIPSet'
Resource:
- !GetAtt WebACLStack.Outputs.WAFScannersProbesSetV4Arn