{"id":40378,"date":"2016-09-26T10:53:36","date_gmt":"2016-09-26T05:23:36","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=40378"},"modified":"2016-09-26T14:56:06","modified_gmt":"2016-09-26T09:26:06","slug":"configuring-rate-based-blacklisting-of-ips-using-aws-waf-and-aws-lambda","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/configuring-rate-based-blacklisting-of-ips-using-aws-waf-and-aws-lambda\/","title":{"rendered":"Configuring Rate-Based Blacklisting of IP’s using AWS WAF and AWS Lambda"},"content":{"rendered":"

One security challenge we face these days is how to prevent our web servers from DDOS attacks.<\/p>\n

This blog illustrates how we can automatically block unwanted traffic based on request rate by using AWS WAF and Lambda. This setup automatically detects traffic based on request rate, and then updates AWS WAF configurations<\/a> to block subsequent requests from those users.<\/p>\n

\"Heitor_ArchitectureandFlowa\"<\/p>\n

The above diagram explains the entire setup.<\/p>\n

It works as follows:<\/p>\n

As CloudFront receives requests on behalf of our web application, it sends access logs to an S3. A Lambda function<\/a> gets triggered for every new access log stored in the S3 bucket.The Lambda function identifies the IP addresses which have made more requests than the defined threshold and adds the resulting \u00a0IP addresses to AWS WAF block list. AWS WAF blocks these IP addresses for a period of time. After this blocking period gets expired, AWS WAF allows these IP addresses to access our application again, but it still continues to monitor the requests from those IP addresses for a certain period of time. The Lambda function also publishes execution metrics in CloudWatch, such as the number of requests analyzed and IP addresses blocked.<\/p>\n

<\/div>\n

Follow the following steps in order to implement the above setup:<\/p>\n

    \n
      \n
    1. Sign in to AWS Console. Click on Services and select Cloudformation<\/strong>.<\/li>\n
    2. Click on \u201cCreate New Stack\u201d button.<\/li>\n
    3. Upload the waf_template.json this GitHub repositor<\/a>y on \u201cSelect Template<\/strong>\u201d page.<\/li>\n
    4. Click \u201cNext<\/strong>\u201d:\"Screenshot<\/li>\n
    5. On the Specify Details<\/strong> page:\n
        \n
      • For the \u201cStack name<\/strong>\u201d field, type the name of your stack.<\/li>\n
      • For \u201cCreate CloudFront Access Log Bucket<\/strong>\u201d field, select \u201cyes<\/strong>\u201d to create a new S3 bucket for CloudFront Access Logs.<\/li>\n
      • For \u201cCloudFront Access Log Bucket Name<\/strong>\u201d field, type the name of the S3 bucket where CloudFront will send access logs.<\/li>\n
      • For \u201cRequest Threshold<\/strong>\u201d field, specify the maximum number of requests that can be made per minute without being blocked.<\/li>\n
      • For \u201cWAF Block Period<\/strong>\u201d field, specify for how long (in seconds) IP addresses should be blocked after passing the threshold.<\/li>\n
      • For \u201cWAF Quarantine Period<\/strong>\u201d, specify for how long AWS WAF should monitor IP addresses after AWS WAF has stopped blocking them.<\/li>\n
      • Click \u201cNext<\/strong>\u201d:<\/li>\n<\/ul>\n

        \"Screenshot<\/p>\n<\/li>\n

      • On the Options<\/strong> page, click Next<\/strong>.<\/li>\n
      • On the Review<\/strong> page, Click create<\/strong>.<\/li>\n<\/ol>\n<\/ol>\n

        This template will create all the components necessary to run the above-defined setup: a Lambda function and an AWS WAF Web ACL (named Malicious Requesters) with all necessary rules configured.<\/p>\n

          \n
        1. Now open CloudFront<\/strong> Console.<\/li>\n
        2. Select the distribution for which you want this setup to be configured.<\/li>\n
        3. In the Distribution Settings pane<\/strong>, click the General tab, and then click Edit.\n
            \n
          • Edit AWS WAF Web ACL<\/strong> settings. From the drop-down list, select the WEB ACL which was created in the earlier steps (Malicious Requesters).<\/li>\n
          • For Logging<\/strong>, select On<\/strong>.<\/li>\n
          • In \u201cBucket for Logs<\/strong>\u201d field, select the bucket that you specified in the earlier step.<\/li>\n
          • Save your changes:<\/li>\n<\/ul>\n

            \"Screenshot<\/p>\n<\/li>\n<\/ol>\n

            This will successfully provision the setup that automatically blocks IP addresses based on a specified request-rate threshold.<\/p>\n","protected":false},"excerpt":{"rendered":"

            One security challenge we face these days is how to prevent our web servers from DDOS attacks. This blog illustrates how we can automatically block unwanted traffic based on request rate by using AWS WAF and Lambda. This setup automatically detects traffic based on request rate, and then updates AWS WAF configurations to block subsequent […]<\/p>\n","protected":false},"author":914,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":36},"categories":[1174,2348,1],"tags":[2270,2937,2366,1679,1332,2532,3233,2932,1892],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/40378"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/914"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=40378"}],"version-history":[{"count":0,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/40378\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=40378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=40378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=40378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}