AWS WAF efficient rule for allowing specific IPs and Countries for specific URLs

0
  1. I want to allow abc.example.com/* in a specific country xyz what will be best rule for it ?
  2. what will be rule in case to allow only specific ips to acces abc.example.com?
已提問 2 年前檢視次數 309 次
2 個答案
0

You could accomplish this via rules in a Web ACL in AWS WAF. A geomatching rule like this:

Action": {
    "Block": {}
    "Statement": {
       "NotStatement": {
          "Statement": {
"GeoMatchStatement": {
          "CountryCodes": [
            "CA"
                      ]
        }

in your Web ACL would block all traffic except traffic originating in Canada.

You can also restrict access to an approved group of IP addresses by creating a list of addresses in WAF, and then creating a rule in the Web ACL to allow only those IP addresses.

profile picture
jwesley
已回答 2 年前
  • Good , but I want to know e.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URL

  • Good , but I want to know e.g. I have multiple URLs i.e. abc.example.ccom, xyz.example.com, ghi.example1.com, example2.com etc. and I want to block on specific URL e.g. abc.example.com ....out of multiple URLs how can I do for a specific URL

0

You need to write a string match or regex match rule that looks at host header field AND put another condition to look for the country you want to allow. You may want to set web ACL default action to block as well.

Might want to look at this as well https://www.youtube.com/watch?v=ll-uvVgQ3Jg (skip to 50%)

{
  "Name": "test-rule",
  "Priority": 0,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "test-rule"
  },
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "Host"
              }
            },
            "PositionalConstraint": "STARTS_WITH",
            "SearchString": "abc.example.com",
            "TextTransformations": [
              {
                "Type": "LOWERCASE",
                "Priority": 0
              }
            ]
          }
        },
        {
          "GeoMatchStatement": {
            "CountryCodes": [
              "US"
            ]
          }
        }
      ]
    }
  }
}
AWS
已回答 2 年前
  • Thanks @Kumo-Hiyori for a reply, I try the above rule with country statement and without country statement, but it doesn't work.

    I don't know what's the reason behind But Then I try single statement rule looking for single header host starts with abc.example.com and block all traffic but it still allows , I don't know why ,

    Any solution?

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南