By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

AWS WAF is blocking CloudWatch's Synthetic Canary

1

Hello, Is anyone else having issues with the Synthetic Canaries being blocked by the AWS WAF Managed Rules' AWSManagedIPReputationList and/or AWSManagedReconnaissanceList?

Is there a way to let the WAF know that those requests are safe?

Right now my approach has been to whitelist the public IP of the request (but this IP is dynamic os it won't last long) or set to count those rules but then I'm leaving a little bit open the site.

Thanks for you comments. Regards.

Topics
Security, Identity, & ComplianceNetworking & Content DeliveryManagement & Governance
Tags
AWS WAFAWS Firewall ManagerNetworking & Content DeliveryAmazon CloudWatch
Language
English
profile picture
Higher
asked 2 years ago1307 views
2 Answers
2

One option you have is to configure your Canary to use a specific request header or cookie, then look for the presence of that in a custom WAF rule. You could either allow the traffic and not process any other rules, or you could add a label, which you could then use in a scope-down statement to bypass the rule(s) that are currently blocking your Canary

AWS
EXPERT
Paul_L
answered 2 years ago
  • Higher
    2 years ago

    Thanks for the reply. By any change do you have an example of how to insert a custom header in the Canary code, I have very little knowledge of NodeJS.

    Kind Regards.

0

You can put all your canaries in the VPC and then whitelist your NAT Gateway IPs from Web ACL. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_VPC.html

Krishan
answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content