Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Validate Request Headers at WAF Layer to Avoid ECS App Changes?

0

My application is built based on a Docker image and deployed with ECS + ALB +WAF. I need to validate a request header signature that's dynamically injected when users submit data. This validation requires an external API call. To avoid change source code and docker image, is there way perform the signature validation at the waf layer ? I am thinking about a Lambda but not sure if is feasible. Any help and suggestions would be greatly appreciated. Thanks!

Topics
MicroservicesComputeSecurity, Identity, & Compliance
Tags
MicroservicesAWS WAFAWS Lambda
Language
English

asked a year ago241 views

1 Answer
1
Accepted Answer

Hello.

If you can introduce CloudFront, you can use CloudFront Functions or Lambda@Edge etc.
If you can use CloudFront Functions, I think it is possible to validate the request headers in Lambda before they reach the ALB.
Since AWS WAF does not allow you to call external APIs, you will need to run Lambda or something similar somewhere.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html

It is also possible to set Lambda as a target for ALB, so I think this method can also be used.
https://docs.aws.amazon.com/lambda/latest/dg/services-alb.html

EXPERT

answered a year ago

EXPERT

reviewed 2 months ago

  • Jo
    a year ago

    Hi Riku, thanks a lot for your help. The Lambda@Edge appears to work with Cloudfront, though I haven't implemented with the real case, but seems a workable approach. However, I thought ALB is for traffic routing, a bit confused about how it can work as a security layer to validate then send the request through. could you explain that a bit more? Thanks again.

  • Riku_Kobayashi EXPERT
    a year ago

    ALB allows for things like header checking in listener rules. For example, if the value of the Authorization header is different from what was set in the listener rules, it is possible to forward it to Lambda, so we thought it would be possible to check the header at that time. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html#add-rule

    • HTTP header – Enter the name of the header and add one or more comparison strings. To save the condition, choose Confirm.
      • HTTP header name – Rule will assess requests containing this header to confirm matching values.
        Maximum 40 characters. Not case sensitive. Allowed characters are a-z, A-Z, 0-9, and the following special characters: *?-!#$%&'+.^_`|~. Wildcards are not supported.
      • HTTP header value – Enter strings to compare against the HTTP header value.
        Maximum 128 characters. Not case sensitive. Allowed characters are a-z, A-Z, 0-9; spaces; the following special characters: !"#$%&'()+,./:;<=>@[]^_`{|}~-; and wildcards (* and ?).

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content