​
Event Information

  • The CreateRegexPatternSet event in AWS WAF refers to the action of creating a new regex pattern set within the Web Application Firewall (WAF) service.
  • A regex pattern set is a collection of regular expressions that can be used to match and block specific patterns or strings in incoming web requests.
  • This event indicates that a new regex pattern set has been created, which can then be associated with a WAF web ACL to provide protection against common web application attacks.

​
Examples

  1. Inadequate pattern matching: If the regular expression pattern used in CreateRegexPatternSet for AWS WAF is not properly defined, it may result in false positives or false negatives. This can lead to legitimate requests being blocked or malicious requests being allowed, compromising the security of the application.

  2. Insufficient coverage: If the regex pattern set created with CreateRegexPatternSet does not cover all possible attack vectors or patterns used by attackers, it may leave the application vulnerable to security threats. It is important to thoroughly analyze the application’s input and potential attack vectors to ensure comprehensive coverage in the regex pattern set.

  3. Performance impact: Creating a regex pattern set with overly complex or inefficient regular expressions can impact the performance of the AWS WAF. If the regex patterns are too resource-intensive, it may result in increased latency or resource consumption, affecting the overall performance of the application. It is crucial to optimize the regex patterns to strike a balance between security and performance.

​
Remediation

​
Using Console

  1. Identify the specific AWS WAF rule that needs to be remediated based on the examples provided.

    • Log in to the AWS Management Console.
    • Navigate to the AWS WAF service.
    • Select the appropriate WebACL that contains the rule to be remediated.

  2. Modify the AWS WAF rule to address the identified issue.

    • Within the selected WebACL, locate the rule that needs to be remediated.
    • Click on the rule to access its configuration settings.
    • Adjust the rule parameters or conditions to align with the desired remediation action.
    • Save the changes made to the rule.

  3. Test and monitor the remediated AWS WAF rule.

    • Deploy the updated WebACL to the desired AWS resource (e.g., Amazon CloudFront distribution, Application Load Balancer).
    • Generate test traffic or simulate attacks to verify that the remediated rule is functioning as expected.
    • Continuously monitor the AWS WAF logs and metrics to ensure that the remediated rule is effectively blocking or allowing the desired traffic.

Note: The exact steps may vary slightly depending on the specific AWS WAF rule and the AWS Management Console version being used. It is recommended to refer to the AWS documentation for detailed instructions and screenshots.

​
Using CLI

  1. To remediate a specific rule in AWS WAF using AWS CLI, you can use the update-rule command. For example, if you want to update a rule with the ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:

    aws wafv2 update-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --action ALLOW --override-action NONE

    This command updates the specified rule in the WebACL, setting the action to ALLOW and overriding any previous actions.

  2. To remediate a rate-based rule in AWS WAF using AWS CLI, you can use the update-rate-based-rule command. For example, if you want to update a rate-based rule with the ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:

    aws wafv2 update-rate-based-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --rate-limit 1000

    This command updates the specified rate-based rule in the WebACL, setting the rate limit to 1000 requests per 5 minutes.

  3. To remediate a managed rule group in AWS WAF using AWS CLI, you can use the update-managed-rule-set-version command. For example, if you want to update a managed rule group with the ARN arn:aws:wafv2:us-west-2:123456789012:managed-rule-set/aws-managed/gbqj2j5k5k-owasp-top-10 to the latest available version, you can use the following command:

    aws wafv2 update-managed-rule-set-version --name gbqj2j5k5k-owasp-top-10 --scope REGIONAL --vendor-name aws-managed

    This command updates the specified managed rule group to the latest available version, ensuring that you have the latest security protections in place.

​
Using Python

  1. Example 1: Blocking IP addresses with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to retrieve the IP addresses that need to be blocked.
    • Use the create_ip_set method to create an IP set in AWS WAF.
    • Use the update_ip_set method to add the IP addresses to the IP set.
    • Use the update_web_acl method to associate the IP set with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Retrieve IP addresses to block
ip_addresses = ['192.0.2.1', '203.0.113.2']

# Create IP set
response = waf_client.create_ip_set(
    Name='BlockedIPSet',
    ChangeToken='CHANGE_TOKEN'
)

# Add IP addresses to IP set
response = waf_client.update_ip_set(
    IPSetId='IP_SET_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'IPSetDescriptor': {
                'Type': 'IPV4',
                'Value': ip_address
            }
        }
        for ip_address in ip_addresses
    ]
)

# Associate IP set with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': 'AWSManagedRuleSetRuleId'
            }
        }
    ]
)
  1. Example 2: Creating rate-based rules with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to define the rate-based rule parameters.
    • Use the create_rate_based_rule method to create the rate-based rule.
    • Use the update_web_acl method to associate the rate-based rule with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Define rate-based rule parameters
rule_name = 'RateBasedRule'
metric_name = 'RuleMetric'
rate_limit = 100
rate_key = 'IP'

# Create rate-based rule
response = waf_client.create_rate_based_rule(
    Name=rule_name,
    MetricName=metric_name,
    RateLimit=rate_limit,
    ChangeToken='CHANGE_TOKEN',
    MatchPredicates=[
        {
            'Negated': False,
            'Type': 'IPMatch',
            'DataId': 'IP_SET_ID',
            'Value': rate_key
        }
    ]
)

# Associate rate-based rule with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': response['Rule']['RuleId']
            }
        }
    ]
)
  1. Example 3: Creating custom rules with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to define the custom rule parameters.
    • Use the create_rule method to create the custom rule.
    • Use the update_web_acl method to associate the custom rule with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Define custom rule parameters
rule_name = 'CustomRule'
metric_name = 'RuleMetric'
statement = {
    'ByteMatchStatement': {
        'FieldToMatch': {
            'Type': 'HEADER',
            'Data': 'User-Agent'
        },
        'PositionalConstraint': 'CONTAINS',
        'SearchString': 'bad-bot'
    }
}

# Create custom rule
response = waf_client.create_rule(
    Name=rule_name,
    MetricName=metric_name,
    ChangeToken='CHANGE_TOKEN',
    Statements=[
        {
            'ByteMatchStatement': statement
        }
    ]
)

# Associate custom rule with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': response['Rule']['RuleId']
            }
        }
    ]
)

Note: Replace the placeholders (CHANGE_TOKEN, IP_SET_ID, WEB_ACL_ID, etc.) with the actual values specific to your AWS WAF configuration.