FMS Policy Owner Specifies WebACLId

More Info:

Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions. When AWS Firewall Manager creates this rule, the FMS policy owner specifies the WebACLId in the FMS policy and can optionally enable remediation.

Risk Level

Medium

Address

Security

Compliance Standards

CBP

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI, you can follow these steps:

Identify the FMS Policy Owner: First, identify the FMS Policy Owner who has specified the WebACLId for the Elastic Load Balancer.
Revoke Permissions: The FMS Policy Owner needs to revoke the permission to specify the WebACLId for the Elastic Load Balancer. This can be done by updating the FMS policy or removing the specific permission from the IAM policy attached to the FMS Policy Owner.
Update WebACLId for the Elastic Load Balancer: If the WebACLId specified by the FMS Policy Owner is incorrect or causing issues, you can update the WebACLId for the Elastic Load Balancer. Use the following AWS CLI command to update the WebACLId for the Elastic Load Balancer:
```
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn> --attributes Key=aws.wafv2.webacl,Value=<new-webacl-id>
```
Replace <your-load-balancer-arn> with the ARN of your Elastic Load Balancer and <new-webacl-id> with the correct WebACLId that you want to associate with the Elastic Load Balancer.
Verify the Changes: After updating the WebACLId for the Elastic Load Balancer, verify the changes by checking the attributes of the Elastic Load Balancer using the following AWS CLI command:
```
aws elbv2 describe-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn>
```
Ensure that the correct WebACLId is now associated with the Elastic Load Balancer.

By following these steps, you can remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI.

Using Python

To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for AWS Elastic Load Balancer using Python, you can follow these steps:

Identify the Misconfiguration: Check the AWS WAF WebACL associated with the Elastic Load Balancer to ensure that the FMS Policy Owner does not specify a specific WebACLId.
Update the WebACL: Use the AWS SDK for Python (Boto3) to update the WebACL associated with the Elastic Load Balancer. You can remove the FMS Policy Owner’s specified WebACLId and revert to the default WebACL or a more appropriate one.
Install Boto3: If you haven’t already, install the Boto3 library by running the following command:
```
pip install boto3
```

Python Script to Remediate: Here is a sample Python script that demonstrates how to update the WebACL associated with an Elastic Load Balancer:

import boto3

elb_client = boto3.client('elbv2')

# Specify the ARN of the Elastic Load Balancer
elb_arn = 'YOUR_ELB_ARN_HERE'

# Specify the ARN of the desired WebACL
web_acl_arn = 'YOUR_WEBACL_ARN_HERE'

# Update the WebACL associated with the Elastic Load Balancer
response = elb_client.modify_load_balancer_attributes(
    LoadBalancerArn=elb_arn,
    Attributes=[
        {
            'Key': 'aws:waf:webacl',
            'Value': web_acl_arn
        }
    ]
)

print('WebACL updated successfully.')

Replace the placeholders:
- Replace YOUR_ELB_ARN_HERE with the ARN of your Elastic Load Balancer.
- Replace YOUR_WEBACL_ARN_HERE with the ARN of the desired WebACL that you want to associate with the Elastic Load Balancer.
Run the Script: Execute the Python script to update the WebACL associated with the Elastic Load Balancer. This will remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId.

By following these steps and running the Python script, you can successfully remediate the misconfiguration for an AWS Elastic Load Balancer where the FMS Policy Owner Specifies WebACLId.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

FMS Policy Owner Specifies WebACLId

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation