AppSync Should Be Associated With WAF

More Info:

This rule verifies whether AWS AppSync resources are associated with AWS WAF (Web Application Firewall) to protect against common web exploits and security vulnerabilities. Associating AppSync with WAF allows for the enforcement of custom access control rules and provides an additional layer of security against malicious traffic

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
StateRAMP
UK NCSC Cyber Assessment Framework

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Sign in to the AWS Management Console.
Navigate to the AWS AppSync service. You can find this by typing ‘AppSync’ into the search bar at the top of the console.
Once in the AppSync dashboard, select the API that you want to check for WAF association.
In the settings or details of the selected API, look for a section or field related to AWS WAF. If the API is associated with a WAF, it should be listed here. If there is no such section or the field is empty, then the API is not associated with a WAF.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the resources.
Once the AWS CLI is set up, you can list all the AppSync APIs in your account by running the following command:
aws appsync list-graphql-apis --region your-region
Replace ‘your-region’ with the region where your resources are located. This command will return a list of all the AppSync APIs in the specified region.
For each AppSync API, you can check if it is associated with a Web Application Firewall (WAF) by running the following command:
aws wafv2 list-web-acls --scope REGIONAL --region your-region
This command will list all the Web ACLs in the specified region. You need to check if the ARN of your AppSync API is present in the list.
If the ARN of your AppSync API is not present in the list, it means that the API is not associated with a WAF. You can use a Python script to automate this process. The script will iterate over all the AppSync APIs and check if they are associated with a WAF. If an API is not associated with a WAF, the script will print a message indicating the misconfiguration.

Using Python

To check if AppSync is associated with WAF in AWS using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps:

Setup AWS SDK for Python (Boto3): First, you need to set up Boto3 on your machine. You can install it using pip:
pip install boto3
Then, configure your AWS credentials. You can do this by creating the files ~/.aws/credentials and ~/.aws/config:
~/.aws/credentials: [default] aws_access_key_id = YOUR_ACCESS_KEY aws_secret_access_key = YOUR_SECRET_KEY ~/.aws/config: [default] region=us-east-1
Create a Python script to list all AppSync APIs: Use the list_graphql_apis method to get all the AppSync APIs. Here is a sample script:
import boto3 client = boto3.client('appsync') response = client.list_graphql_apis() for api in response['graphqlApis']: print(api['name'], api['apiId'])
This script will print the name and ID of all your AppSync APIs.
Create a Python script to get the WAF web ACL for each AppSync API: Use the get_web_acl_for_resource method to get the WAF web ACL for each AppSync API. Here is a sample script:
import boto3 client = boto3.client('wafv2') response = client.get_web_acl_for_resource( ResourceArn='arn:aws:appsync:us-east-1:123456789012:apis/YourApiId' ) print(response['WebACL'])
Replace ‘YourApiId’ with the ID of your AppSync API. This script will print the WAF web ACL for the specified AppSync API.
Check if the WAF web ACL is associated with the AppSync API: If the get_web_acl_for_resource method returns a web ACL, then the AppSync API is associated with WAF. If it returns an error or an empty result, then the AppSync API is not associated with WAF. You can add this check to your script:
if 'WebACL' in response: print('AppSync API is associated with WAF') else: print('AppSync API is not associated with WAF')
This script will print whether the specified AppSync API is associated with WAF or not.

Remediation

Using Console

To associate AWS AppSync with AWS WAF (Web Application Firewall) in AWS console, follow these steps:

Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to the AWS Management Console using your credentials.
Navigate to AWS AppSync service: Click on the “Services” dropdown menu at the top of the console, search for “AppSync” in the search bar, and click on “AWS AppSync” to open the AWS AppSync console.
Select the AppSync API: In the AWS AppSync console, select the API that you want to associate with AWS WAF from the list of APIs displayed.
Click on “Settings” tab: Once you have selected the API, click on the “Settings” tab in the left-hand menu to configure the settings for the selected API.
Enable AWS WAF: In the “Settings” tab, look for the “Security” section and find the option to enable AWS WAF. Click on the “Edit” button next to the AWS WAF option.
Associate AWS WAF with the API: In the AWS WAF configuration settings, you can choose to associate an existing AWS WAF web ACL with the API or create a new web ACL. Select the appropriate option based on your requirements.
Configure AWS WAF settings: If you are creating a new web ACL, follow the on-screen instructions to configure the AWS WAF settings such as rules, conditions, and actions to protect your API from common web exploits and attacks.
Save the changes: After configuring the AWS WAF settings, click on the “Save” or “Update” button to associate AWS WAF with the selected AppSync API.
Verify the association: Once the changes are saved, verify that AWS WAF is successfully associated with the AWS AppSync API by checking the settings and configurations in the AWS AppSync console.

By following these steps, you can remediate the misconfiguration by associating AWS AppSync with AWS WAF in the AWS console to enhance the security of your API.

Using CLI

To associate AWS AppSync with AWS WAF using AWS CLI, follow these steps:

Create a WebACL in AWS WAF:

aws wafv2 create-web-acl --name "MyAppSyncWebACL" --scope REGIONAL --default-action "Allow={}" --description "WebACL for protecting AppSync"

Get the WebACL ARN:

export WEBACL_ARN=$(aws wafv2 list-web-acls --scope REGIONAL --query "WebACLs[?Name=='MyAppSyncWebACL'].ARN" --output text)

Update the AWS AppSync API with the WebACL ARN:

aws appsync update-graphql-api --api-id YOUR_API_ID --additional-authentication-providers "WAF={WebACLArn=$WEBACL_ARN}"

Replace YOUR_API_ID with the ID of your AWS AppSync API.

Verify the association by checking the AWS AppSync API details:

aws appsync get-graphql-api --api-id YOUR_API_ID --query "additionalAuthenticationProviders"

Now, your AWS AppSync API is associated with AWS WAF for protection.

Using Python

To associate AWS AppSync with AWS WAF (Web Application Firewall) using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the AWS clients for AppSync and WAF:

appsync_client = boto3.client('appsync')
wafv2_client = boto3.client('wafv2')

Get the API ID of your AWS AppSync API:

response = appsync_client.list_graph_ql_apis()
api_id = response['graphQLApis'][0]['apiId']

Create a WebACL in AWS WAF:

web_acl_response = wafv2_client.create_web_acl(
    Name='MyAppSyncWebACL',
    Scope='REGIONAL',  # or set it to 'CLOUDFRONT' if using a CloudFront distribution
    DefaultAction={
        'Allow': {}
    },
    Description='WebACL for protecting AppSync API',
    Rules=[]
)
web_acl_id = web_acl_response['WebACL']['Id']

Associate the WebACL with your AWS AppSync API:

appsync_client.associate_web_acl(
    ApiId=api_id,
    WebAclArn=web_acl_id
)

Verify the association:

response = appsync_client.get_web_acl_association(
    ApiId=api_id
)
print(response)

By following these steps, you can associate AWS AppSync with AWS WAF using Python. This will help protect your AppSync API from common web attacks and vulnerabilities.

Using Terraform

# Existing AppSync GraphQL API
resource "aws_appsync_graphql_api" "this" {
  name                = "APP_SYNC_API_NAME"
  authentication_type = "API_KEY"

  # ...other required AppSync configuration...
}

# Pre-existing WAFv2 Web ACL (must be REGIONAL and in same region as AppSync)
resource "aws_wafv2_web_acl" "this" {
  name  = "WAF_WEB_ACL_NAME"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    sampled_requests_enabled   = true
    metric_name                = "WAF_WEB_ACL_METRIC_NAME"
  }

  # ...rules as needed...
}

# Associate the AppSync API with the WAF Web ACL
resource "aws_wafv2_web_acl_association" "appsync_waf" {
  resource_arn = aws_appsync_graphql_api.this.arn
  web_acl_arn  = aws_wafv2_web_acl.this.arn
}

Substitute:

APP_SYNC_API_NAME with your AppSync API name.
WAF_WEB_ACL_NAME and WAF_WEB_ACL_METRIC_NAME with your desired WAF Web ACL names/metrics.

This association does not force replacement of the AppSync API; it adds or updates the WAF attachment.For verification, terraform plan should show creation of aws_wafv2_web_acl_association.appsync_waf with resource_arn equal to the AppSync API ARN and web_acl_arn equal to the desired WAF Web ACL ARN.

Additional Reading:

https://docs.aws.amazon.com/config/latest/developerguide/appsync-associated-with-waf.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

AppSync Should Be Associated With WAF

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation

Additional Reading: