How do I associate a WAF with an API Gateway?

0

I set up an API Gateway route, which works. I now want to protect it with a WAF.

I found https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html, which refers to a "Settings" tab inside the stage editor in API Gateway; this doesn't exist for me. All that I see associated with the stage are stage variables and tags.

Likewise, from the WAF, it looks like I should be able to associate an API Gateway resource with the WAF; however, my route/stage isn't findable in any of the dialogs.

What gives? I am on free tier for both, if that is a factor.

6 Antworten
3
profile pictureAWS
EXPERTE
kentrad
beantwortet vor einem Jahr
profile picture
EXPERTE
überprüft vor einem Jahr
2

Hi, WAF is available for Rest api type as mentioned above.

If you have http api type, you can either front your api Gateway with CloudFront and associate WAF with CloudFront, or add an Application Load Balancer (ALB) after the api gateway, and associate WAF with the ALB.

Hope it helps ;)

profile picture
EXPERTE
beantwortet vor einem Jahr
profile picture
EXPERTE
überprüft vor einem Jahr
1

The following steps in AWS WAF will help you to set up the system.
When linking AWS WAF Web ACLs, create a Web ACL in the same region as the API Gateway.
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html

profile picture
EXPERTE
beantwortet vor einem Jahr
0

Ah yes, you are right. Sorry, was confused by the region in the top bar, which is set to global when I click to ACLs. However, I have the same view as you for the actual creation; and, my ACL is created in US-east-1, as is the API gateway. Here's what I see:

Enter image description here

Enter image description here

Enter image description here

Enter image description here

beantwortet vor einem Jahr
  • Although the protocol is HTTP, WAF can only be configured for Rest API. Are you creating an API Gateway with Rest API?

0

Yeah, that doesn't work either because the API Gateway resource is not listed in the Add AWS Resources tab.

The region might be the issue - I can only create ACLs in "Global" (they others are grayed out), whereas the API Gateway is us-east-1.

beantwortet vor einem Jahr
0

My screen allows me to choose a region on the Web ACL screen.
waf

When creating the Web ACL, did you select "Regional resources"?
waf1

profile picture
EXPERTE
beantwortet vor einem Jahr

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen