Block IP address permanently if WAF blocks IP programmatically

How to block IP address permanently if WAF blocks request of that IP after matching a rate limit rule. Currently , I see manually listing that IP adresses in IP set details under AWS Waf. Instead of manually inserting that blocked IP address, how to make automatic list of blocked IP addresses once WAF blocks it.

主题

安全、身份和合规性网络和内容交付

标签

AWS WAF 网络和内容交付

语言

English

Techxonia

已提问 2 年前1730 查看次数

1 回答

最新
投票最多
评论最多

Hi Techxonia!

This article explains how can you update WAF rules in real time: https://aws.amazon.com/blogs/security/automatically-updating-aws-waf-rule-in-real-time-using-amazon-eventbridge/

Piotr Blonkowski

已回答 2 年前

Techxonia
2 年前
Thank you for response and still confused to solve the issue that WAF takes about 30 sec to act according to rule action (as per documentation). another issue that I could not solve is https://repost.aws/questions/QUNQvDBuveTF655KQOTpxjfw/waf-didnt-block-requests-if-block-condition-matched-for-first-time

Summary of qn Using locust , I made WAF test on my application. I made a rate limit based rule to block IP if requests exceed 100 in a default 5 minute window. When I tested with concurrency 400 with spawn rate 40, then WAF doesnot block after total requests exceeds 100. But when I stop the test and make a new test in locust and then only WAF blocks that IP for 5 min .

I tested many times and found when I make a first locust test , WAF is not working even if condition meets. But it works if I stop that test and make a new test. My purpose of blocking through WAF seems not feasible since attacker can make attack with huge requests and that won't be blocked.

I have enabled WAF on API gateway.

Can I have idea on this?

Block IP address permanently if WAF blocks IP programmatically

相关内容