Questions tagged with AWS Firewall Manager

I am following this tutorial https://aws.amazon.com/blogs/security/deploy-dashboard-for-aws-waf-minimal-effort/ but when I select my region and load a template I get error api_error_message_500 Why I am getting this error? Is there any other quick way to start getting WAF logs on Kibana Dashboard?

Hi all, Last 2 weeks i am facing Remote desktop connection problem. I am new in AWS. A few day back, I had received an account suspension mail because of payment due. I made all the payment done. Now i am getting this error on login with RDP. "RDP credential were use to connect did not work, please enter new credential " During this I followed some steps to solve the error: 1.) My Security Group setting:- Inbound rules are:- Http, Https, SSH, RDP, all TCP, All Traffic, Custom TCP for IPV4 and IPV6. Outbound Rules are: All Traffic, HTTP, Custom TCP, HTTPS, SSH for IPV4 and IPV6. 2.) IAM Manager :- Create Role for AmazonEc2RoleforSSM Policy This My Inline Policy ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:PutParameter" ], "Resource": [ "arn:aws:ssm:us-east-2:939764493069:parameter/EC2Rescue/Passwords/i-063933c590287f4d2" ] } ] } ``` 3.) By using System Manager Run command, Changed the current password of windows as well but it's not working. 4.) Also Tried to ping the Public IPv4 address from the local machine but it's working. firewall also take off. 5.) Also tried changing internet service provider. I don't know what am I doing wrong. Is my account is isolated ? Is my setting is wrong? Could you please provide solution.

Recently, saw a huge spike in the Route 53 queries for unidentified domain names. Looks like some scan tools query not existing domain which is hosted on Amazon Route 53 public host zone. For example, they query abc.abcde.<company>.com. The request amount over 1 billion and we have to pay extra. How do I stop this from happening?

In all own created rules, the custom response body can be set. But I don't find such option for AWS bot control block requests response. How to set custom response body for AWS bot control?

Is there a way in which I can Export the Inbound Rules for a network ACL?? Currently everytime a new server is created on AWS, and we setup the rules we have to manually key in the inbound rules each time? sometimes they have up to 18 entries on them. Is there a way so export and import these on the console???

While I deploy AWS WAF Security Automation, following is rule priority as I remove SQL injection. ``` APIWafSecurityAutomationWhitelistRule Allow 1 - APIWafSecurityAutomationBlacklistRule Block 2 - APIWafSecurityAutomationHttpFloodRateBasedRule Block 4 - APIWafSecurityAutomationScannersAndProbesRule Block 5 - ``` How to change priority in the list so that ScannersAndProbesRule comes before HTTP Flood rate based rule? I don't see option to rearrange the priority order?

I am trying to create AWS firewall manager for security group audits using terraform. I dont see a schema definition on what might needed for a custom protocol lists. I dont see an option to pass my custom protocol list the schema is only allowing an existing list id. ``` { type = "SECURITY_GROUPS_CONTENT_AUDIT" preManagedOptions = [{ "allowedProtocolsLists" : { "defaultListId" : "" } }, { "auditSgDirection" : { "type" : "ALL" } }] } ```

I am trying to create AWS firewall manager using terraform. I dont see a schema definition on what might needed for a custom protocol lists. I dont see an option to pass my custom protocol list the schema is only allowing an existing list id. ``` { type = "SECURITY_GROUPS_CONTENT_AUDIT" preManagedOptions = [{ "allowedProtocolsLists" : { "customListId" : "" } }, { "auditSgDirection" : { "type" : "ALL" } }] } ```

Hi all, I'm using CloudFormation to manage AWS Firewall Policy. Following the document here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fms-policy.html I have defined `SecurityServicePolicyData` with type `WAFV2`. Example Code ``` "ManagedServiceData": "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}" ``` Now I want to exclude one of the rules within `AWSManagedRulesCommonRuleSet` but I don't see any guidelines or examples to do that. My question is how to exclude one of the rules within `AWSManagedRulesCommonRuleSet` for example with CloudFormation. ? Regards,

Using locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window. When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min . I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked. I have enabled WAF on API gateway.

Hello, Is anyone else having issues with the Synthetic Canaries being blocked by the AWS WAF Managed Rules' AWSManagedIPReputationList and/or AWSManagedReconnaissanceList? Is there a way to let the WAF know that those requests are safe? Right now my approach has been to whitelist the public IP of the request (but this IP is dynamic os it won't last long) or set to count those rules but then I'm leaving a little bit open the site. Thanks for you comments. Regards.

I'm trying to create a firewall rule group in AWS Network firewall of type strict order, when I paste in the suricata rules e.g emerging threats rules: https://rules.emergingthreats.net/open/suricata-5.0/rules/ it complains with "RulesString is invalid". If I pick the default rule order, I can save it. Any idea why I can't save emerging rules with strict order processing? How can I get this to work with strict order? Thanks! cd