How do I allow a dynamic IP address from a provider or partner when using the anonymous IP list in AWS WAF?

Question

Dear all,

I am facing issues with the partner sending requests to our resource that the anonymous IP list rule has blocked. As per checking, our partner is using dynamic IP  so it's challenging to whitelist their IP. Do you have any advice to filter better than whitelist?

Thank you for your answer.

Didier_Durand · Answer

Hi, if possible, you may want your partner to add a custom header or a query string parameter (what come after the ? in URL) that you agree upon in the request as per https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-regex-conditions.html

Then, you filter on the presence of this header. This has some limitations as some hacker may fake the specific header of param that you add.

So, optimal solution is provided by the "Intelligent Threat API" but it's more demanding sincet his  API needs to integrated in the application. See https://docs.aws.amazon.com/waf/latest/developerguide/waf-js-challenge-api.html

Your use case will dictate the amount of work that you want / can inject in your new WAF filtering

Best,
Didier

How do I allow a dynamic IP address from a provider or partner when using the anonymous IP list in AWS WAF?

Relevant content