FMS Policy Owner Specifies WebACLId

Using Console

To remediate the misconfiguration where FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using the AWS console, follow these step-by-step instructions:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login with your credentials.
Navigate to AWS WAF & Shield: In the AWS Management Console, navigate to the AWS WAF & Shield service by typing “WAF” in the search bar and selecting the “AWS WAF & Shield” service.
Select the Web ACL: In the AWS WAF & Shield dashboard, select the Web ACL that is associated with the FMS Policy Owner Specifies WebACLId misconfiguration.
Remove Web ACL from FMS Policy: Find the option to remove the Web ACL from the FMS Policy Owner in the Web ACL settings. This will ensure that the FMS Policy Owner no longer specifies the WebACLId for the Elastic Load Balancer.
Save Changes: Once you have removed the Web ACL from the FMS Policy Owner, save the changes to update the configuration.
Verify Configuration: Verify that the Web ACL is no longer specified by the FMS Policy Owner for the Elastic Load Balancer. You can do this by checking the configuration settings or testing the Elastic Load Balancer to ensure it is functioning correctly.

By following these steps, you should be able to successfully remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using the AWS console.

Using CLI

To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI, you can follow these steps:

Identify the FMS Policy Owner: First, identify the FMS Policy Owner who has specified the WebACLId for the Elastic Load Balancer.
Revoke Permissions: The FMS Policy Owner needs to revoke the permission to specify the WebACLId for the Elastic Load Balancer. This can be done by updating the FMS policy or removing the specific permission from the IAM policy attached to the FMS Policy Owner.
Update WebACLId for the Elastic Load Balancer: If the WebACLId specified by the FMS Policy Owner is incorrect or causing issues, you can update the WebACLId for the Elastic Load Balancer. Use the following AWS CLI command to update the WebACLId for the Elastic Load Balancer:
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn> --attributes Key=aws.wafv2.webacl,Value=<new-webacl-id>
Replace <your-load-balancer-arn> with the ARN of your Elastic Load Balancer and <new-webacl-id> with the correct WebACLId that you want to associate with the Elastic Load Balancer.
Verify the Changes: After updating the WebACLId for the Elastic Load Balancer, verify the changes by checking the attributes of the Elastic Load Balancer using the following AWS CLI command:
aws elbv2 describe-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn>
Ensure that the correct WebACLId is now associated with the Elastic Load Balancer.

By following these steps, you can remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI.

Using Python

To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for AWS Elastic Load Balancer using Python, you can follow these steps:

Identify the Misconfiguration: Check the AWS WAF WebACL associated with the Elastic Load Balancer to ensure that the FMS Policy Owner does not specify a specific WebACLId.
Update the WebACL: Use the AWS SDK for Python (Boto3) to update the WebACL associated with the Elastic Load Balancer. You can remove the FMS Policy Owner’s specified WebACLId and revert to the default WebACL or a more appropriate one.
Install Boto3: If you haven’t already, install the Boto3 library by running the following command:
pip install boto3

Python Script to Remediate: Here is a sample Python script that demonstrates how to update the WebACL associated with an Elastic Load Balancer:

import boto3

elb_client = boto3.client('elbv2')

# Specify the ARN of the Elastic Load Balancer
elb_arn = 'YOUR_ELB_ARN_HERE'

# Specify the ARN of the desired WebACL
web_acl_arn = 'YOUR_WEBACL_ARN_HERE'

# Update the WebACL associated with the Elastic Load Balancer
response = elb_client.modify_load_balancer_attributes(
    LoadBalancerArn=elb_arn,
    Attributes=[
        {
            'Key': 'aws:waf:webacl',
            'Value': web_acl_arn
        }
    ]
)

print('WebACL updated successfully.')

Replace the placeholders:
- Replace YOUR_ELB_ARN_HERE with the ARN of your Elastic Load Balancer.
- Replace YOUR_WEBACL_ARN_HERE with the ARN of the desired WebACL that you want to associate with the Elastic Load Balancer.
Run the Script: Execute the Python script to update the WebACL associated with the Elastic Load Balancer. This will remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId.

By following these steps and running the Python script, you can successfully remediate the misconfiguration for an AWS Elastic Load Balancer where the FMS Policy Owner Specifies WebACLId.

Using Terraform

resource "aws_lb" "ALB_FOR_WAF" {
  name               = "ALB-FOR-WAF"
  internal           = false
  load_balancer_type = "application"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # substitute your subnet IDs

  tags = {
    "SecurityGroup" = "FMS-WAF-PROTECTED"        # substitute to match your FMS policy tag filter
  }
}

resource "aws_wafv2_web_acl" "WAFV2_WEB_ACL" {
  name        = "fms-waf-alb-web-acl"
  description = "Web ACL for ALB protected by FMS"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "fms-waf-alb-web-acl"
    sampled_requests_enabled   = true
  }
}

resource "aws_fms_policy" "FMS_WAFV2_ALB_POLICY" {
  name                  = "fms-wafv2-alb-policy"
  delete_all_policy_resources = false
  remediation_enabled         = true
  exclude_resource_tags       = false

  # Target ALBs with this tag; must match tags on your ALB(s)
  resource_tags = {
    "SecurityGroup" = "FMS-WAF-PROTECTED"       # substitute as needed
  }

  # Target Application Load Balancers
  resource_type = "APPLICATION_LOAD_BALANCER"

  security_service_policy_data {
    type = "WAFV2"

    # The verified CLI remediation edits this JSON; Terraform must provide the same
    managed_service_data = jsonencode({
      type = "WAFV2"

      # Required: specify the WebACL that FMS should associate
      webAclId = aws_wafv2_web_acl.WAFV2_WEB_ACL.arn

      defaultAction = {
        type = "ALLOW"
      }

      # Example pre-process rule groups; substitute your required rule group ARNs
      preProcessRuleGroups = [
        {
          ruleGroupType = "RuleGroup"
          ruleGroupArn  = "arn:aws:wafv2:REGION:ACCOUNT_ID:regional/rulegroup/RULE_GROUP_NAME/RULE_GROUP_ID" # substitute
          overrideAction = {
            type = "NONE"
          }
        }
      ]

      postProcessRuleGroups = []

      overrideCustomerWebACLAssociation = true

      visibilityConfig = {
        cloudWatchMetricsEnabled = true
        metricName               = "fms-wafv2-alb-web-acl"
        sampledRequestsEnabled   = true
      }
    })
  }
}

Updating aws_fms_policy.FMS_WAFV2_ALB_POLICY in Terraform changes the policy in place (no resource replacement), but it replaces the entire policy definition on the FMS side in the same way as aws fms put-policy, so review carefully to avoid unintended security changes.For verification, terraform plan should show an in-place update of aws_fms_policy.FMS_WAFV2_ALB_POLICY, with changes only to security_service_policy_data[0].managed_service_data (and any new tags/associations) to include the webAclId and any rule group ARNs you configured.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

FMS Policy Owner Specifies WebACLId

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: