You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/app-central/integrations/aws-waf.md
+181-2Lines changed: 181 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,10 +9,60 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
9
9
***Version: 1.1
10
10
Updated: March 26, 2025***
11
11
12
+
## Overview
13
+
### Purpose
12
14
AWS WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define.
15
+
This integration is designed to manage and retrieve WAF security configurations, including IP sets, regex pattern sets, rule groups, and WebACLs. It enables you to define, update, delete, and retrieve security rule assets that inspect and control web request traffic.
13
16
14
-
## Actions
17
+
### Use cases
18
+
* Creating and managing IP allowlists/denylists
19
+
* Defining regex-based pattern rules for request inspection
20
+
* Grouping multiple rules in custom rule groups
21
+
* Fetching details and summaries of rule components
22
+
* Updating existing rules in response to new threats
23
+
24
+
### Supported Versions
25
+
This integration supports **WAFv2 API** actions and works with resources.
26
+
It is compatible with all standard environments where WAFv2 actions are supported.
Once the information is filled in, click on Test to quickly verify that the provided details are correct.
61
+
62
+
### Verification
63
+
To verify the integration is working, execute any Enrichment action, or once resource created test the resource.
64
+
65
+
## Actions
16
66
***Create IP Set** (*Containment*) - Creates an IPSet, used to identify web requests that originate from specific IP addresses or ranges of IP addresses.
17
67
***Create Regex Pattern Set** (*Containment*) - Creates a RegexPatternSet, which you reference in a RegexPatternSetReferenceStatement, to have AWS WAF inspect a web request component for the specified patterns.
18
68
***Create Rule Group** (*Containment*) - Creates a RuleGroup per the specifications provided.
@@ -32,6 +82,133 @@ AWS WAF is a web application firewall that helps protect web applications from a
32
82
***List Web ACLs** (*Enrichment*) - Retrieves a list of WebACLSummary objects for the web ACLs that you manage.
33
83
***Update IP Set** (*Containment*) - Updates the specified IPSet.
34
84
85
+
## Usage
86
+
### Basic Usage
87
+
* Create an IP Set (allow/block IPs)
88
+
* Create a Regex Pattern Set (match request components)
89
+
* Group rules using Rule Groups
90
+
* Retrieve or list existing components for monitoring or inspection
91
+
### Advanced Usage
92
+
* Bulk Listing & Auditing: List all rule groups, regex sets, IP sets, and WebACLs and map their usage across resources
93
+
94
+
## API Reference
95
+
### Configuration
96
+
Each API call uses the following structure:
97
+
* Method: Generally POST or GET depending on the action.
**Delete IP Set / Regex Pattern Set / Rule Group**
151
+
* Method: POST
152
+
* Action: Delete_(TYPE)
153
+
* Required Parameters:
154
+
* Id, Name, Scope, LockToken
155
+
156
+
### Enrichment APIs
157
+
**Get IP Set / Rule Group / Web ACL / Managed Rule Set**
158
+
* Method: GET
159
+
* Action: Get(Type) ex: Get IP Set/Get Rule Group
160
+
* Required Parameters:
161
+
* Id, Name, Scope
162
+
163
+
**List IP Sets / Regex Pattern Sets / Rule Groups / Web ACLs / Managed Rule Sets**
164
+
* Method: GET
165
+
* Action: List(Type)s
166
+
* Optional Parameters: Limit, NextMarker
167
+
168
+
**List Resources for Web ACLs**
169
+
* Method: GET
170
+
* Action: ListResourcesForWebACL
171
+
* Required Parameters:
172
+
* WebACLArn
173
+
174
+
### Rate Limits and Quotas
175
+
````
176
+
API Type Quota / Rate Limit
177
+
IP sets per region 100
178
+
Regex sets per region 100
179
+
Rule groups per region 100
180
+
API Transactions (TPS) ~5-10 TPS per account per API
181
+
````
182
+
**Limits may vary by region and can be increased via AWS Support.**
183
+
184
+
## Troubleshooting
185
+
### Common Issues
186
+
````
187
+
ISSUES DESCRIPTION SOLUTION
188
+
WAFNonexistentItemException Occurs when trying to access or delete a non-existent resource Double-check the Id, Name, and Scope. Use List APIs to confirm existence.
189
+
WAFOptimisticLockException Indicates a stale or missing LockToken when updating or deleting resources Always fetch the latest LockToken using Get API before performing updates/deletes.
190
+
WAFInvalidParameterException One or more parameters are invalid or missing Verify that all required parameters are included and correctly formatted (e.g., CIDR for IP sets).
191
+
ThrottlingException Request rate exceeds allowed TPS Implement exponential backoff and retry logic. Respect rate limits defined in your account.
192
+
AccessDeniedException Occurs when permissions are insufficient Check IAM roles and policies assigned to the user or service making the request. Ensure wafv2:* permissions are included.
193
+
Resource still appears after deletion A deleted IPSet, RuleGroup, etc. still seems accessible in the UI or APIs Allow a few seconds for propagation. Use Get<Type> or List<Type>s to confirm removal.
194
+
IP addresses not being blocked Traffic from listed IPs still reaches the application Ensure the IPSet is attached to a WebACL and the WebACL is associated with the resource (e.g., CloudFront or ALB).
195
+
````
196
+
### FAQs
197
+
* Q1: Can I reuse an IPSet in different rule groups?
198
+
* Yes, an IPSet can be used in several rule groups or WebACLs. You don’t need to create a new one for each use.
199
+
* Q2: What’s the difference between REGIONAL and CLOUDFRONT scopes?
200
+
* REGIONAL is used for AWS services like Application Load Balancers, API Gateway, and App Runner.
201
+
* CLOUDFRONT is specifically for CloudFront distributions and must be managed in the US East (N. Virginia) region.
202
+
* Q3: Why aren’t my changes showing up right away?
203
+
* Updates can take a few moments to fully apply within AWS. Try retrieving the latest configuration using the appropriate Get<Type> API call to confirm.
204
+
* Q4: What if the IP address I provide isn’t in CIDR format?
205
+
* If the IP isn’t formatted correctly (e.g., missing the CIDR suffix), AWS WAF will return a WAFInvalidParameterException. Make sure IPs follow the CIDR notation like 192.0.2.0/24.
0 commit comments