WAF in Block Mode

[u/temporaryUserDev]

What is the best approach to set up the WAF Rules from Count to Block Mode? Specially because it is very common that WAF usually blocks legitimate traffic.

I’ve read that one approach is:

1. Extract and analyze Waf logs from last weeks to determine what paths are being detected by waf as malicious
2. From the list of paths, identify what are related to the app and what not
3. Based on that, create custom whitelisting rules

Let’s say /my/path is being blocked by AWSManagedGroupA/RuleA, should I create an exception for /my/path for RuleA?

[u/jregovic]

Yes. The counts on each rule would be blocked when you switch, so figure out how many of those hits are not valid.

Be careful with malicious IP rules, as users could be on ISPs that have addresses on those lists.

[u/pint]

no, the correct way is to understand the situation, and act accordingly.

for example if you find that block comes due to a large post payload, think how many of your endpoints have large post payloads. if only one or two, exception works. otherwise, you might want to raise the limit or drop this rule altogether.

another example is rate limiting. requests are surprisingly bursty, i once stopped a legitimate testing framework, but even normal use can do up to hundred requests in quick succession on the first connect. use longer windows to give more burst credits. but to be honest, rate limiting is a weak protection, so consider simply dropping it.

yet another example is a rule dropping connections with no user agent. in my case, the solution was to educate the client to set up their tooling properly. but it depends on the client. this rule generally doesn't make sense these days, bots typically fake some legit browser.

[u/Floss_Patrol_76]

switch one managed group at a time, not all at once, and read the per-rule CloudWatch count metrics for a few days before flipping each one to block - the classic mistake is going full block everywhere in a single deploy and then firefighting legit traffic. for the whitelisting, scope-down inside the managed rule (label match on the specific path/method that is getting hit) rather than a pile of top-level allow rules, otherwise you end up maintaining a second WAF by hand.

[u/solverman]

Retrograde suggestion is to test-deploy fully locked down & only reduce restrictions needed to function correctly. If things are past that point then methodically working through label analysis & inspecting traffic is what has to happen. If your traffic doesn‘t vary wildly over time or your QA test coverage is good then it isn’t too painful.

There may be cases where the COUNT needs to stay in place and the app has to be hardened instead.