Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Using Lambda to Radware WAF

0

This question concerns what I found out here: https://repost.aws/questions/QUE_fY6Le_TtGjsj6r9il-zw/few-lambda-invocations-compared-to-cdn-invocations

We determined that AWS can optimize the lambda invocation based on expected responses. But then what happens if I use a Lambda to work with a WAF? How can I ensure that the WAF does its job, preventing abuses?

I assume I could even add a timestamp to make all the calls go to the Lambda (and therefore to the WAF). But at that point I see huge costs coming, especially during intense periods of traffic.

So economically speaking, the wisest choice would be using the CDN itself and having the WAF as origin and then it's the WAF that should transparently send the traffic back when valid.

Am I right, or am I right?

Topics
ServerlessComputeNetworking & Content Delivery
Tags
Amazon CloudFrontAWS Lambda
Language
English

asked 2 years ago185 views

2 Answers
1
Accepted Answer

You are thinking in the right track. Better to have CloudFront as the entry point, to enable caching and global distribution of your content. Attach WAF to CloudFront so that all requests are screened before reaching your Lambda function, and depending on your needs, you can use a standard origin (e.g., S3, EC2) or Lambda@Edge for custom processing.

See here for more details. https://aws.amazon.com/developer/application-security-performance/articles/cost-optimization/

answered 2 years ago

EXPERT

reviewed a year ago

  • Otacon
    2 years ago

    Hello,

    I don't know if I was clear enough, but in the scenario I was talking about the Lambda itself works as WAF (calls the WAF internally and decides if the request goes to origin or gets blocked).

    Same question: would the lambda use the optimization logics (and therefore could be skipped unless configured accordingly)? And should we also manage invocation limits and stuff? Would in the end that be cost effective if we set up a way to get all the requests to the lambda?

    Thanks a lot

  • Otacon
    2 years ago

    But by the way, you answered...it's like we thought. Better having the WAF in front of the CDN. That can also screen the CDN from attacks (resulting in cost optimization as well).

1

My recommendation is not to use custom lambda code acting as WAF, as WAF is more comprehensive and right service to protect resources.

answered 2 years ago

  • Otacon
    2 years ago

    Alright, thanks a lot! We're proceeding with the WAF in front :)

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content