AWS Security, Identity & Compliance - WAF and Shield

 

AWS WAF is a web application firewall service that helps protect your web apps from common exploits that could affect app availability, compromise security, or consume excessive resources.

AWS Shield provides expanded DDoS attack protection for your AWS resources. Get 24/7 support from our DDoS response team and detailed visibility into DDoS events.

AWS Firewall Manager simplifies your AWS WAF administration and maintenance tasks across multiple accounts and resources.

Step 1: Create 2 EC2 instances in different AZs and install httpd and update the index.html file under /var/www/html folder so that you can differentiate these 2 instances' webservers.

• sudo su
• yum install httpd -y
• systemctl start httpd
• echo "<h1> Server1 </h1>" > /var/www/html/index.htm
• echo "<h1> Server2 </h1>" > /var/www/html/index.html

Step 2: Create Application LB by creating a single Target Group by registering both instances. (Click on Target Group rather than Application Load Balancing)

Step 3: Get your public IP address so that we can restrict to access ALB from the system.

Step 4: Go to WAF---> IPSets

Step 5: Set following Configuration

• IP Set Name: MyIPSet
• Region: Select your region
• Add Your IP Address in IP addresses.like 27.7.187.246/32
• Click on Create IP Set

Step 6: Select Web ACL --> Click on Create WebACL

Step 7: Provide the details like

• Name: MyWebAcl
• Click on Add AWS resources button and select your ALB
• Click on Next Button

Step 8: Add Rule by click on Add Rule--> Add my own rule.

Step 9: Name the rule and select IPSet and select your IP, select and click on Block access

Step 10: Reset of the options no change and Create on WebACL button.

Try to access your ALB on web it should be forbidden

to delete

need to delete the application load balancer first,

then delete target groups,

then delete webACLS,

then delete IPsets,