En utilisant AWS re:Post, vous acceptez les AWS re:Post Conditions d’utilisation
AWS re:Postre:Post

HTTP API GW -> (WAF) -> ALB, cannot pick up source IP

0

I have an HTTP API GW that connects to a private ALB via VPC Link.

But i cannot make WAF understand the forwarded HTTP header that APIGW sets

forwarded: for=someip;host=somehost;proto=https

From what i understand WAF wants a CSV type of input in the header it reads for IP and uses the first one and the documentation states that it's usually X-Forwarded-For

Is there any way of making WAF understand the format that HTTP API GW is sending to ALB?

Sujets
Sécurité, identité et conformitéSans serveurWeb et mobile front-endRéseaux et diffusion de contenu
Balises
AWS WAFPasserelle API AmazonElastic Load Balancing
Langue
English
Alexander
demandé il y a un an383 vues
1 réponse
0

The WAF attached to the ALB which is behind API Gateway does not recognize the source IP of the client. One approach would be to front CloudFront before API Gateway and have AWS WAF on CloudFront Alternatively you could use HTTP API GW -> WAF -> NLB -> ALB. Or Switching to port base routing as opposed to path based routing and changing from ALB to NLB.

profile pictureAWS
EXPERT
PiyushMattoo
répondu il y a un an
  • alexander
    il y a un an

    I tried placing a CF in front of the GW (which is the cleaner solution i agree), but for the life of me I could not make it work

    Followed several guides but i only ended up with "< x-cache: Error from cloudfront"

    Route53 -> CF -> custom domain in my HTTP API GW

    Anyone had similar issues?

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions

Contenus pertinents