AWS Web Application Firewall (WAF)

A web application firewall is in place to protect public-facing web applications from outside threats.

WAF should be appropriately deployed and configured to appropriately block malicious traffic.

There should be a single Global WAF ACL set.

If WAF is not enabled or there are no rulesets configured:

Recommended Solution:

Enable a Web Application Firewall (WAF) for all public-facing web applications. Configure it with standard security rulesets (e.g., OWASP Core Rule Set) to detect and block common attacks such as SQL injection, XSS, and request smuggling. Regularly update and tune the rules to minimize false positives.

Risks and Side Effects:

Implementing or tightening WAF rules may initially block legitimate traffic or cause application performance degradation if not tuned properly. Continuous monitoring and rule adjustments are required to balance security and usability.

How to Check if Affected Resources Handle Customer Data:

Review application documentation and data flow diagrams to determine which web applications process or serve customer data. Check whether endpoints behind the affected web servers are used for customer authentication, data input forms, or APIs that exchange customer information. If logs or configuration files reference customer databases or CRM integrations, those applications are considered to handle customer data.

What are the resources in aws that should be behind WAF?

In AWS, any internet-facing resource that serves web traffic or APIs should ideally be protected by a Web Application Firewall (WAF). Here’s a breakdown of the main AWS resources that should be behind WAF, depending on how your architecture is set up:

1. Amazon CloudFront Distributions

Why: CloudFront is often the first entry point for global web traffic. Applying WAF at this layer helps block malicious requests before they reach your origin servers.

Use case: Static websites, dynamic web applications, APIs, or content delivery networks (CDNs).

2. Application Load Balancers (ALB)

Why: ALBs route traffic to backend EC2 instances, containers, or Lambda functions. WAF at this level protects internal applications or microservices exposed to the internet.

Use case: Web apps, REST APIs, or services behind an ALB.

3. Amazon API Gateway

Why: API Gateway endpoints are public by default and can expose critical business logic. WAF helps prevent attacks like injection, scraping, and DoS attempts.

Use case: Public or partner-facing APIs.

4. AWS AppSync (GraphQL APIs)

Why: GraphQL APIs are vulnerable to overly complex queries and enumeration attacks. WAF can enforce query depth limits and request validation.

Use case: Mobile or web applications using GraphQL.

5. Amazon Cognito Hosted UI (optional)

Why: If you expose Cognito’s hosted UI for user sign-up or login, WAF can help protect against brute-force or injection attacks.

Use case: Authentication portals for customers or employees.

6. AWS Elastic Beanstalk Environments

Why: Beanstalk apps typically use an ALB or CloudFront. Apply WAF at the load balancer or CloudFront layer to protect the Beanstalk environment.

Use case: Managed web applications deployed through Elastic Beanstalk.

7. Public-Facing EC2 Instances (if not behind ALB)

Why: Directly exposed EC2 web servers are vulnerable entry points. A WAF can protect HTTP/HTTPS traffic through an AWS WAF-enabled CloudFront distribution or ALB placed in front.

Use case: Legacy applications or custom web servers.

Rule of Thumb

If the AWS resource:

• Accepts HTTP/HTTPS requests directly from the internet, and
• Handles customer data or serves data to customers

...then it should be behind AWS WAF (via CloudFront, ALB, or API Gateway integration).

AWS WAF Coverage Checklist

Here’s a short, practical checklist you can use to verify that all applicable AWS resources are protected by a WAF — either for internal compliance tracking (e.g., Drata) or automated auditing (e.g., AWS Config, Security Hub).

1. Identify Public-Facing Entry Points

 List all CloudFront distributions, ALBs, API Gateways, and AppSync APIs.

Use the AWS CLI or console:

aws cloudfront list-distributions

aws elbv2 describe-load-balancers

aws apigateway get-rest-apis

aws appsync list-graphql-apis

 Confirm which ones have a public DNS name or public IP (internet-facing).

2. Check for WAF Associations

 For each CloudFront distribution, confirm it has an associated WAF WebACL:

aws wafv2 list-web-acls --scope CLOUDFRONT

 For each Application Load Balancer:

aws wafv2 list-web-acls --scope REGIONAL

 For each API Gateway or AppSync API:

aws wafv2 list-web-acls --scope REGIONAL

 Verify that the WebACLs are actively associated with the resources above.

3. Review WAF Configuration

 Ensure WAF WebACLs use AWS Managed Rules (e.g., AWSManagedRulesCommonRuleSet, SQLiRuleSet).

 Check for custom rules or rate-based rules to block brute force or scraping.

 Verify logging is enabled to CloudWatch Logs or S3 for auditability.

4. Confirm Coverage for Customer-Data Applications

 Identify which web apps/APIs process customer data or serve data to customers (e.g., sign-in pages, dashboards, APIs).

 Ensure those endpoints are behind a CloudFront or ALB with WAF enabled.

 For internal-only services, document why WAF protection is not required (for audit traceability).

5. Ongoing Monitoring

 Enable AWS Config rule: wafv2-webacl-resource-association-check

→ Automatically detects if CloudFront, ALB, or API Gateway resources lack WAF association.

 Integrate findings into AWS Security Hub or Drata evidence collection for continuous compliance.

How to Setup a VPN Connection between the office router and AWS VPN?

How to setup a IPSEC VPN Connection between our office router e.g. Cisco ASA and the AWS VPN endpoints?

AWS Virtual Private Network solutions establish secure connections between our on-premises networks, remote offices, client devices, and the AWS global network. 

AWS VPN is comprised of two services: AWS Site-to-Site VPN and AWS Client VPN. 

Each service provides a highly-available, managed, and elastic cloud VPN solution to protect our network traffic.

In this article we'll talk about AWS Site-to-Site VPN.

AWS Site-to-Site VPN 

Network diagram:

on-premise LAN: 192.168.0.0/16 

-----------------------------------------

/ \                         / \

 |                           |

 |  active tunnel            |  passive (standby) tunnel

 |                           |

\ /                         \ /

-----------------------------------------

Router1                    Router 2

VGW - Virtual Gateway 

VPC: 172.16.0.0/16; Route Table: 192.168.0.0/16 ---> VGW-xxxx

Can VPC CIDR and LAN CIDR overlap?

VPN connection consists of two tunnels:

• active (up and running)
• passive (down); if first one goes down, this one will take over

VPC route table will need to be modified so traffic destined for 192.168.0.0/16 to be routed to VGW-xxxx

AWS VPN service consists of 3 components:

• Customer Gateway
• Customer side of the connection e.g. Cisco ASA
• aws_customer_gateway | Resources | hashicorp/aws | Terraform | Terraform Registry
• Virtual Private Gateway 
• Router on the AWS side of the VPN tunnel
• aws_vpn_gateway | Resources | hashicorp/aws | Terraform | Terraform Registry 
• VPN connection itself
• Bundles together info about above two
• aws_vpn_connection | Resources | hashicorp/aws | Terraform | Terraform Registry
• 
  

Creating and configuring a Customer Gateway

Customer Gateway is a resource that we create in AWS that represents the a (customer) gateway device in our on-premises network.

When we create a customer gateway, we provide information about our device to AWS. We or our network administrator must configure the device to work with the site-to-site VPN connection.

We first need to create a Customer Gateway in AWS. We can do that via AWS console or Terraform provider. 

If we click on Create customer gateway, we'll see this form:

Details

• Name tag
• optional
• Creates a tag with a key of 'Name' and a value that we specify.
• Value must be 256 characters or less in length.
• BGP ASN
• The ASN of our customer gateway device.
• e.g. 65000
• Value must be in 1 - 4294967294 range.
• The Border Gateway Protocol (BGP) Autonomous System Number (ASN) in the range of 1 – 4,294,967,294 is supported. We can use an existing public ASN assigned to our network, with the exception of the following:
• 7224 - Reserved in all Regions
• 9059 - Reserved in the eu-west-1 Region
• 10124 - Reserved in the ap-northeast-1 Region
• 17943 - Reserved in the ap-southeast-1 Region
• If we don't have a public ASN, we can use a private ASN in the range of 64,512–65,534 or 4,200,000,000 - 4,294,967,294. The default ASN is 65000.
• It is required if we want to set up dynamic routing. If we want to use static routing, we can use an arbitrary (default) value.
• Where to find BGP ASN for e.g. UDM Pro?
• If we want to use IPSec and dynamic routing, then our router device needs to support BGP over IPSec
• When to use static and when to use dynamic routing?
• IP address
• Specify the IP address for our customer gateway device's external interface. This is internet-routable IP address for our gateway's external interface.
• The address must be static and can't be behind a device performing Network Address Translation (NAT)
• If office router is connected to ISP via e.g. WAN1 connection, this is the IP of that WAN connection 
• Basically, this is the office's public IP address.
• Certificate ARN
• optional
• The ARN of a private certificate provisioned in AWS Certificate Manager (ACM).
• We can select certificate ARN from a drop-down list
• How is this certificate used?
• When to use this certificate?
• Device
• optional
• A name for the customer gateway device.

Creating and configuring a Virtual private gateway

A virtual private gateway is the VPN concentrator on the Amazon side of the site-to-site VPN connection. We create a virtual private gateway and attach it to the VPC we want to use for the site-to-site VPN connection.

A VPN concentrator is a specialized networking device designed to manage numerous secure connections (VPN tunnels) for remote users or sites accessing a central network. It acts as a central point for establishing, processing, and maintaining these connections, enabling large organizations to securely connect many users simultaneously. 

Key Functions:

• Multiple VPN Tunnel Management: VPN concentrators handle a large number of encrypted VPN tunnels simultaneously, allowing multiple users to securely connect to the network. 
• Centralized Security: They provide a central point for managing and enforcing security policies for all remote connections, ensuring consistent protection. 
• Scalability: VPN concentrators are designed to handle a large number of users and connections, making them suitable for large organizations with many remote workers or sites. 
• Traffic Encryption: They encrypt all data transmitted between the remote user and the central network, ensuring secure communication and protecting sensitive information. 
• Enhanced Security Posture: By managing and controlling all VPN connections, they help organizations maintain a strong security posture and minimize risks associated with remote access. 

How it Works:

• 1. Remote User Connection: Remote users initiate a VPN connection, which is then routed to the VPN concentrator. 
• 2. Authentication and Authorization: The concentrator authenticates and authorizes the user, verifying their identity and permissions. 
• 3. Tunnel Establishment: If the user is authorized, the concentrator establishes an encrypted VPN tunnel between the user's device and the central network. 
• 4. Secure Communication: All data transmitted through the tunnel is encrypted, protecting it from eavesdropping or interception. 
• 5. Traffic Management: The concentrator manages and prioritizes traffic within the network, ensuring efficient and secure communication. 

Use Cases:

• Large Enterprises: Companies with numerous remote employees often use VPN concentrators to provide secure access to their internal network. 
• Extranet VPNs: VPN concentrators are also used in extranet setups, where multiple organizations need to securely share resources and information. 
• Large Scale Remote Access: They are ideal for organizations that need to provide secure remote access to a large number of users from various locations. 

In essence, a VPN concentrator is a robust and scalable solution for managing secure remote access in larger organizations, providing the necessary infrastructure for secure and efficient communication across the network

If we click on Create button we'll get this form to fill:

If we select Custom ASN:

Upon creation, VGW will be in detached state. We want to attach it to VPC.

We can select to which VPC we want to attach it to.

How to open ports on Ubuntu

I've recently had a situation where I was running HTTP server (written in Go) on port 8080 on my Ubuntu machine and had to access it from my Windows machine (which was on the same network). At first I got a connection time out error and I assumed Ubuntu was just rejecting connections for not having 8080 port opened. I was right. I used UFW (Uncomplicated Firewall) to open port on my Linux machine. UFW comes with Ubuntu (18.04 in my case) so didn't have to install any additional packages.


Let's see all ufw commands:

$ ufw --help
Usage: ufw COMMAND

Commands:
 enable                          enables the firewall
 disable                         disables the firewall
 default ARG                     set default policy
 logging LEVEL                   set logging to LEVEL
 allow ARGS                      add allow rule
 deny ARGS                       add deny rule
 reject ARGS                     add reject rule
 limit ARGS                      add limit rule
 delete RULE|NUM                 delete RULE
 insert NUM RULE                 insert RULE at NUM
 route RULE                      add route RULE
 route delete RULE|NUM           delete route RULE
 route insert NUM RULE           insert route RULE at NUM
 reload                          reload firewall
 reset                           reset firewall
 status                          show firewall status
 status numbered                 show firewall status as numbered list of RULES
 status verbose                  show verbose firewall status
 show ARG                        show firewall report
 version                         display version information

Application profile commands:
 app list                        list application profiles
 app info PROFILE                show information on PROFILE
 app update PROFILE              update PROFILE
 app default ARG                 set default application policy

You need to be root in order to perform majority of ufw operations.

To check firewall's status (whether it's active or not):

$ sudo ufw status

To enable it:

$ sudo ufw enable

To open 8080 port for TCP connections:

$ sudo ufw allow 8080/tcp

To verify the result:

$ sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
8080/tcp                   ALLOW       Anywhere                  
8080/tcp (v6)              ALLOW       Anywhere (v6) 

Resources:

UFW - Community Help Wiki