Put a web application firewall and flood protection in front of public services

How to do it

A flood of traffic fills a server's link or its connection table long before the app sees a request. An edge network or the cloud's own protection, such as AWS Shield or Google Cloud Armor, absorbs floods at network level. A web application firewall then filters requests with rate rules per address and managed rule sets, such as the OWASP Core Rule Set. It buys time, but it never replaces fixing the hole in the code. Run new rules in count mode for 7 days, read what they would have blocked, and add exceptions for named paths. Keep the origin reachable only from the edge, as Let only your edge network reach the origin says. Per-client limits stay in the app, as Limit how often anyone can call your APIs says.

Examples

Terraform example

resource "aws_wafv2_web_acl" "shop" {
  name  = "shop-edge"
  scope = "CLOUDFRONT"
  default_action { allow {} }

  rule {
    name     = "common-attacks"
    priority = 1
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "common-attacks"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "shop-edge"
    sampled_requests_enabled   = true
  }
}

Shell example

# Expect 403 from the edge, and a matching entry in the firewall log
curl -s -o /dev/null -w '%{http_code}\n' 'https://shop.example.com/search?q=<script>alert(1)</script>'

How to check

The DNS for every public host points at the edge. The firewall policy is in code, in block mode, with a managed rule set and a rate rule. A test request with a common attack string, such as ?q=<script>alert(1)</script>, is blocked at the edge and logged.

Sources

• CISA, Understanding and Responding to DDoS Attacks
• OWASP ModSecurity Core Rule Set
• AWS WAF managed rule groups

Related rules

• INF-71 Let only your edge network reach the origin in Infrastructure and environments
• APS-49 Limit how often anyone can call your APIs in Application security