AWS WAF Hands-On: Rate Rules, IP Sets, Geo, SQLi/XSS, Logging आणि Attachments

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचा lab story

Priya Nair (कोची) ALB: office Allow, geo IN+AE, CRS+SQLi, /login rate, 429, S3 logs. Amina Okello = API GW same pattern.

CloudFront attach/HTTPS: survey.

2. Hands-on का?

हे का लागतं?

curl 403 = Block proof. Logs = forensics. Wrong scope = silent fail.

3. काय बनवाल

हे काय आहे?

1. Office IP set
2. Geo IN+AE
3. /login rate
4. SQLi + CRS
5. Custom response
6. Attachments
7. Logging
8. Proofs

4. How: IP + geo + rate

कसं करायचं (step by step)

export AWS_REGION=ap-south-1
export NAME=rb-waf-handson-$(date +%s)

aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32 198.51.100.20/32
# note Id + LockToken from output

# rules.json sketch (priorities):
# 100 Allow if IPSetReference office
# 200 Block if NOT GeoMatch [IN, AE]   (careful with travel users)
# 500 Managed SQLi Count override
# 510 Managed CRS Count override
# 900 RateBasedStatement Limit=1000 AggregateKeyType=IP
#     scoped down with ByteMatch /login in ScopeDownStatement

Rate key: IP / forwarded IP / method / query / header / cookie / label. Abuse नुसार निवडा.

5. SQLi आणि XSS

Managed SQLi + CRS XSS > hand regex. Count first. CMS editor = exclusions.

6. Custom responses

# Custom response body on the Web ACL, then reference from a Block action
# Example: 429 with JSON {"error":"slow_down","retry_after":60}
# Console: Web ACL → Custom response bodies → Add
# Or CLI create-web-acl / update-web-acl with CustomResponseBodies map

7. प्रत्येक resource ला attach

# ALB
aws wafv2 associate-web-acl --web-acl-arn "$WEB_ACL_ARN" --resource-arn "$ALB_ARN" --region $AWS_REGION

# CloudFront (ACL must already exist in us-east-1 with --scope CLOUDFRONT)
aws cloudfront get-distribution-config --id E123 > /tmp/d.json
# set WebACLId to ACL ARN, raise ETag IfMatch, update-distribution

8. Logging

Destinations: S3 / CW Logs / Firehose. Naming aws-waf-logs-* rules पाहा. KMS + lifecycle.

aws wafv2 put-logging-configuration --region $AWS_REGION --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN,RedactedFields=[]
# Then: aws s3 ls s3://aws-waf-logs-rb-lab/ --recursive | tail

9. curl ने test (200 आणि 403)

# ALLOW — normal homepage
curl -s -o /dev/null -w "%{http_code}\n" https://clinic.example.com/
# 200

# BLOCK — classic SQLi probe (after SQLi rules are in Block mode)
curl -s -o /dev/null -w "%{http_code}\n" \
  "https://clinic.example.com/search?q=1%27%20OR%20%271%27%3D%271"
# 403

# RATE — hammer /login from one IP (lab only)
for i in $(seq 1 1200); do curl -s -o /dev/null https://clinic.example.com/login & done
wait
curl -s -o /dev/null -w "%{http_code}\n" https://clinic.example.com/login
# 403 (once rate key exceeds Limit)

10. Multi-industry

• Fintech: API GW + Firehose
• Ecommerce: CF + 429
• SaaS: ALB + CW
• EdTech: Challenge
• Gov: ALB+Cognito

11. Lab: ALB WAF + rate + SQLi + logs

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Create ACL.
2. Add rules.
3. Associate + logs.
4. 200 + 403.
5. Count→Block.

Cleanup (billing थांबवा)

1. Disassociate.
2. Logs cleanup.
3. Delete ACL/IP.

12. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

13. Troubleshooting checklist

1. Scope check.
2. Sampled requests.
3. Priority order.
4. curl -v.
5. Log ruleId.
6. CF region.
7. ALB ARN.
8. Shield health.

14. FAQ

15. Interview Q&A

16. Tips — English, मराठी आणि हिंदी

17. ScopeDown आणि nested

ScopeDown = फक्त /login किंवा JSON. AND/OR/NOT काळजीपूर्वक. Labels > deep trees.

# Pseudo rule: rate only on /login POST
RateBasedStatement:
  Limit: 1000
  AggregateKeyType: IP
  ScopeDownStatement:
    AndStatement:
      Statements:
        - ByteMatchStatement: {SearchString: /login, FieldToMatch: UriPath, ...}
        - ByteMatchStatement: {SearchString: POST, FieldToMatch: Method, ...}

18. Bot Control आणि ATP

Bot Control / ATP = add-on cost. Scrapers → Bot Targeted. Stuffing → ATP. Count first.

19. WAF deploy IAM

• CRUD Web ACL
• Associate
• Logging perms
• Service-linked role
• Prod delete deny

20. Allow/deny matrix

21. Publish करण्याआधी WAF checklist

1. Threat एका वाक्यात.
2. Global vs regional scope.
3. Default action.
4. Priority bands.
5. Count first.
6. CAPTCHA for humans.
7. Logging first.
8. Allow + 403 tests.
9. On-call owner.
10. CF+WAF survey link.

22. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

23. Interview-friendly priority bands

• 0–99: emergency Block
• 100–199: Allow exceptions
• 200–499: geo/bot
• 500–799: Managed Rules
• 800–899: custom
• 900–999: rate-based

छोटा number = उच्च priority. पहिला terminating action जिंकतो. Count terminate होत नाही.

24. Industry story bank

एकच WAF pattern; फक्त IP/geo/URI/rate बदला.

• Fintech: /login /otp rate + CAPTCHA.
• Healthcare: geo + SQLi.
• EdTech: Challenge scrapers.
• Ecommerce: Bot + 429.
• Media: search rate.
• SaaS: webhook allowlist.
• Logistics: geo + rate.
• Gov: CRS + CAPTCHA.
• Gaming: Shield + rate.
• Travel: geo + card-test block.

25. False-positive unlock runbook

1. Sampled / logs → rule id.
2. curl -v reproduce.
3. Block→Count.
4. Narrow Allow above.
5. Label exclusions.
6. Retest + ticket.
7. Default Allow + empty नको.

26. PR review checklist

• Correct scope.
• Priority table.
• Count → Block date.
• Logs encrypted.
• 200 + 403 proofs.
• Survey link.
• Shield decision.

27. या site वरील related chapters

• CF+WAF survey: chapter
• Well-Architected — पुढचा.
• S3 policy projects.

28. Metric आणि alarm starter pack

Day-one alarms. Thresholds = starting points.

• BlockedRequests spike
• CountedRequests review
• ALB 5xx
• ASG at max
• DDoSDetected
• CF error rate
• R53 unhealthy
• Log delivery

29. Sampled requests वाचन

1. Sampled → rule.
2. Action/URI/country.
3. TP/FP/CAPTCHA.
4. Request ids → ticket.
5. Samples+logs.

30. Glossary

31. 15-minute tabletop

1. Scenario inject.
2. Classify.
3. First clicks + page.
4. Comms.
5. Gap note.

32. Cost notes

WAF = ACL+rules+requests; Bot/ATP जास्त. Shield Advanced = monthly+usage. Logs = storage. Budgets ठेवा.

33. WAF पलीकडे hygiene

• No CF bypass.
• IAM least privilege.
• Log bucket BPA.
• Quarterly IP/geo.
• Redact secrets.
• Break-glass doc.

34. इतर chapters शी pairing

Origin OAC = S3 projects. Security pillar = Well-Architected. CDN/HTTPS = CF+WAF survey.

35. Request flow deep dive

Browser → R53 → CF → WAF → (ALB WAF) → app. Shield पहातो. Logs → SOC.

1. DNS+TLS (Shield).
2. Edge WAF.
3. Cache.
4. Origin + regional WAF.
5. ASG serve.
6. Metrics/logs/SRT.

36. Rule JSON anatomy

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

37. Text transformations

• LOWERCASE
• URL_DECODE
• HTML_ENTITY_DECODE
• CMD_LINE
• Compress/Strip
• Ordered transforms

38. Office-hours drills

1. Drill 1 Count.
2. Drill 2 priority.
3. Drill 3 curl.
4. Drill 4 Shield.
5. Drill 5 runbook.
6. Drill 6 region.
7. Drill 7 order.
8. Drill 8 redact.

39. Change calendar

• Day 0
• Day 1
• Day 2–3
• Day 4
• Day 5
• Day 7
• Day 14
• Day 30

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.