{ "Description": "(SO0006-WebACL) - Security Automations for AWS WAF: This AWS CloudFormation template helps you provision the Security Automations for AWS WAF stack without worrying about creating and configuring the underlying AWS infrastructure. **WARNING** This template creates an AWS WAF Web ACL and Amazon CloudWatch custom metrics. You will be billed for the AWS resources used if you create a stack from this template. v4.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Mappings": { "TimeWindowMap": { "1": { "seconds": 60 }, "2": { "seconds": 120 }, "5": { "seconds": 300 }, "10": { "seconds": 600 } }, "SourceCode": { "General": { "TemplateBucket": "solutions-reference", "SourceBucket": "solutions", "KeyPrefix": "security-automations-for-aws-waf/v4.1.4" } } }, "Parameters": { "ActivateAWSManagedRulesParam": { "Type": "String" }, "ActivateAWSManagedAPParam": { "Type": "String" }, "ActivateAWSManagedKBIParam": { "Type": "String" }, "ActivateAWSManagedIPRParam": { "Type": "String" }, "ActivateAWSManagedAIPParam": { "Type": "String" }, "ActivateAWSManagedSQLParam": { "Type": "String" }, "ActivateAWSManagedLinuxParam": { "Type": "String" }, "ActivateAWSManagedPOSIXParam": { "Type": "String" }, "ActivateAWSManagedWindowsParam": { "Type": "String" }, "ActivateAWSManagedPHPParam": { "Type": "String" }, "ActivateAWSManagedWPParam": { "Type": "String" }, "ActivateSqlInjectionProtectionParam": { "Type": "String" }, "ActivateCrossSiteScriptingProtectionParam": { "Type": "String" }, "ActivateHttpFloodProtectionParam": { "Type": "String" }, "ActivateScannersProbesProtectionParam": { "Type": "String" }, "ActivateReputationListsProtectionParam": { "Type": "String" }, "ActivateBadBotProtectionParam": { "Type": "String" }, "RequestThreshold": { "Type": "Number" }, "RegionScope": { "Type": "String" }, "ParentStackName": { "Type": "String" }, "GlueAccessLogsDatabase": { "Type": "String" }, "GlueAppAccessLogsTable": { "Type": "String" }, "GlueWafAccessLogsTable": { "Type": "String" }, "LogLevel": { "Type": "String" }, "SqlInjectionProtectionSensitivityLevelParam": { "Type": "String" }, "WAFRuleKeysTypeParam": { "Type": "String" }, "CustomHeaderNameParam": { "Type": "String" }, "TimeWindowThresholdParam": { "Type": "Number" } }, "Conditions": { "AWSManagedCRSActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedRulesParam" }, "yes" ] }, "AWSManagedAPActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedAPParam" }, "yes" ] }, "AWSManagedKBIActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedKBIParam" }, "yes" ] }, "AWSManagedIPRActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedIPRParam" }, "yes" ] }, "AWSManagedAIPActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedAIPParam" }, "yes" ] }, "AWSManagedSQLActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedSQLParam" }, "yes" ] }, "AWSManagedLinuxActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedLinuxParam" }, "yes" ] }, "AWSManagedPOSIXActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedPOSIXParam" }, "yes" ] }, "AWSManagedWindowsActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedWindowsParam" }, "yes" ] }, "AWSManagedPHPActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedPHPParam" }, "yes" ] }, "AWSManagedWPActivated": { "Fn::Equals": [ { "Ref": "ActivateAWSManagedWPParam" }, "yes" ] }, "SqlInjectionProtectionActivated": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "ActivateSqlInjectionProtectionParam" }, "no" ] } ] }, "SqlInjectionProtectionContinueActivated": { "Fn::Equals": [ { "Ref": "ActivateSqlInjectionProtectionParam" }, "yes" ] }, "SqlInjectionProtectionMatchActivated": { "Fn::Equals": [ { "Ref": "ActivateSqlInjectionProtectionParam" }, "yes - MATCH" ] }, "SqlInjectionProtectionNoMatchActivated": { "Fn::Equals": [ { "Ref": "ActivateSqlInjectionProtectionParam" }, "yes - NO_MATCH" ] }, "CrossSiteScriptingProtectionActivated": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "ActivateCrossSiteScriptingProtectionParam" }, "no" ] } ] }, "CrossSiteScriptingProtectionContinueActivated": { "Fn::Equals": [ { "Ref": "ActivateCrossSiteScriptingProtectionParam" }, "yes" ] }, "CrossSiteScriptingProtectionMatchActivated": { "Fn::Equals": [ { "Ref": "ActivateCrossSiteScriptingProtectionParam" }, "yes - MATCH" ] }, "CrossSiteScriptingProtectionNoMatchActivated": { "Fn::Equals": [ { "Ref": "ActivateCrossSiteScriptingProtectionParam" }, "yes - NO_MATCH" ] }, "HttpFloodLambdaLogParser": { "Fn::Equals": [ { "Ref": "ActivateHttpFloodProtectionParam" }, "yes - AWS Lambda log parser" ] }, "HttpFloodAthenaLogParser": { "Fn::Equals": [ { "Ref": "ActivateHttpFloodProtectionParam" }, "yes - Amazon Athena log parser" ] }, "HttpFloodProtectionActivated": { "Fn::Or": [ { "Condition": "HttpFloodLambdaLogParser" }, { "Condition": "HttpFloodAthenaLogParser" } ] }, "HttpFloodProtectionRateBasedRuleActivated": { "Fn::Equals": [ { "Ref": "ActivateHttpFloodProtectionParam" }, "yes - AWS WAF rate based rule" ] }, "ScannersProbesAthenaLogParser": { "Fn::Equals": [ { "Ref": "ActivateScannersProbesProtectionParam" }, "yes - Amazon Athena log parser" ] }, "ScannersProbesLambdaLogParser": { "Fn::Equals": [ { "Ref": "ActivateScannersProbesProtectionParam" }, "yes - AWS Lambda log parser" ] }, "ScannersProbesProtectionActivated": { "Fn::Or": [ { "Condition": "ScannersProbesLambdaLogParser" }, { "Condition": "ScannersProbesAthenaLogParser" } ] }, "ReputationListsProtectionActivated": { "Fn::Equals": [ { "Ref": "ActivateReputationListsProtectionParam" }, "yes" ] }, "BadBotProtectionActivated": { "Fn::Equals": [ { "Ref": "ActivateBadBotProtectionParam" }, "yes" ] }, "IsDefaultIP": { "Fn::Equals": [ { "Ref": "WAFRuleKeysTypeParam" }, "IP" ] }, "IsCustomHeaderSelected": { "Fn::Equals": [ { "Ref": "WAFRuleKeysTypeParam" }, "IP+Custom Header" ] }, "IsUriPathSelected": { "Fn::Equals": [ { "Ref": "WAFRuleKeysTypeParam" }, "IP+URI" ] }, "IsHttpMethodSelected": { "Fn::Equals": [ { "Ref": "WAFRuleKeysTypeParam" }, "IP+HTTP METHOD" ] } }, "Resources": { "LambdaRoleCustomTimer": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Sub": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*CustomTimer*" } }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "CloudWatchLogs" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE", "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "CustomTimer": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "SourceBucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "timer.zip" ] ] } }, "Description": "This lambda function counts X seconds and can be used to slow down component creation in CloudFormation", "Environment": { "Variables": { "SECONDS": "2", "LOG_LEVEL": { "Ref": "LogLevel" }, "POWERTOOLS_SERVICE_NAME": "CustomTimer" } }, "Handler": "timer.lambda_handler", "MemorySize": 128, "Role": { "Fn::GetAtt": [ "LambdaRoleCustomTimer", "Arn" ] }, "Runtime": "python3.12", "Timeout": 300, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "LambdaRoleCustomTimer" ], "Metadata": { "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "TimerWhiteV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } } }, "TimerBlackV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerWhiteV4" }, "TimerHttpFloodV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerBlackV4" }, "TimerScannersV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerHttpFloodV4" }, "TimerReputationV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerScannersV4" }, "TimerBadBotV4": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerReputationV4" }, "TimerWhiteV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerBadBotV4" }, "TimerBlackV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerWhiteV6" }, "TimerHttpFloodV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerBlackV6" }, "TimerScannersV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerHttpFloodV6" }, "TimerReputationV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerScannersV6" }, "TimerBadBotV6": { "Type": "Custom::Timer", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomTimer", "Arn" ] } }, "DependsOn": "TimerReputationV6" }, "WAFWhitelistSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Allow List for IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}WhitelistSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "DependsOn": "TimerWhiteV4" }, "WAFBlacklistSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Denied List for IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}BlacklistSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "DependsOn": "TimerBlackV4" }, "WAFHttpFloodSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block HTTP Flood IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}HTTPFloodSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "HttpFloodProtectionActivated", "DependsOn": "TimerHttpFloodV4" }, "WAFScannersProbesSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Scanners/Probes IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}ScannersProbesSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "ScannersProbesProtectionActivated", "DependsOn": "TimerScannersV4" }, "WAFReputationListsSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Reputation List IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}IPReputationListsSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "ReputationListsProtectionActivated", "DependsOn": "TimerReputationV4" }, "WAFBadBotSetV4": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Bad Bot IPV4 addresses", "IPAddressVersion": "IPV4", "Name": { "Fn::Sub": "${ParentStackName}IPBadBotSetIPV4" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "BadBotProtectionActivated", "DependsOn": "TimerBadBotV4" }, "WAFWhitelistSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Allow list for IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}WhitelistSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "DependsOn": "TimerWhiteV6" }, "WAFBlacklistSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Denied List for IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}BlacklistSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "DependsOn": "TimerBlackV6" }, "WAFHttpFloodSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block HTTP Flood IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}HTTPFloodSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "HttpFloodProtectionActivated", "DependsOn": "TimerHttpFloodV6" }, "WAFScannersProbesSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Scanners/Probes IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}ScannersProbesSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "ScannersProbesProtectionActivated", "DependsOn": "TimerScannersV6" }, "WAFReputationListsSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Reputation List IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}IPReputationListsSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "ReputationListsProtectionActivated", "DependsOn": "TimerReputationV6" }, "WAFBadBotSetV6": { "Type": "AWS::WAFv2::IPSet", "Properties": { "Addresses": [], "Description": "Block Bad Bot IPV6 addresses", "IPAddressVersion": "IPV6", "Name": { "Fn::Sub": "${ParentStackName}IPBadBotSetIPV6" }, "Scope": { "Fn::Sub": "${RegionScope}" } }, "Condition": "BadBotProtectionActivated", "DependsOn": "TimerBadBotV6" }, "WAFWebACL": { "Type": "AWS::WAFv2::WebACL", "Properties": { "DefaultAction": { "Allow": {} }, "Description": "Custom WAFWebACL", "Name": { "Ref": "ParentStackName" }, "Rules": [ { "Fn::If": [ "AWSManagedCRSActivated", { "Name": "AWS-AWSManagedRulesCommonRuleSet", "Priority": 6, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "MetricForAMRCRS" }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesCommonRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedAPActivated", { "Name": "AWS-AWSManagedRulesAdminProtectionRuleSet", "Priority": 7, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRAP" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesAdminProtectionRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedKBIActivated", { "Name": "AWS-AWSManagedRulesKnownBadInputsRuleSet", "Priority": 8, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRKBI" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesKnownBadInputsRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedIPRActivated", { "Name": "AWS-AWSManagedRulesAmazonIpReputationList", "Priority": 2, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRIPR" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesAmazonIpReputationList" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedAIPActivated", { "Name": "AWS-AWSManagedRulesAnonymousIpList", "Priority": 4, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRAIP" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesAnonymousIpList" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedSQLActivated", { "Name": "AWS-AWSManagedRulesSQLiRuleSet", "Priority": 14, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRSQL" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesSQLiRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedLinuxActivated", { "Name": "AWS-AWSManagedRulesLinuxRuleSet", "Priority": 11, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRLinux" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesLinuxRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedPOSIXActivated", { "Name": "AWS-AWSManagedRulesUnixRuleSet", "Priority": 10, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRPOSIX" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesUnixRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedWindowsActivated", { "Name": "AWS-AWSManagedRulesWindowsRuleSet", "Priority": 9, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRWindows" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesWindowsRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedPHPActivated", { "Name": "AWS-AWSManagedRulesPHPRuleSet", "Priority": 12, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRPHP" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesPHPRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "AWSManagedWPActivated", { "Name": "AWS-AWSManagedRulesWordPressRuleSet", "Priority": 13, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "AMRWP" ] ] } }, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesWordPressRuleSet" } } }, { "Ref": "AWS::NoValue" } ] }, { "Action": { "Allow": {} }, "Name": { "Fn::Sub": "${ParentStackName}WhitelistRule" }, "Priority": 0, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFWhitelistSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFWhitelistSetV6", "Arn" ] } } } ] } }, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "WhitelistRule" ] ] }, "SampledRequestsEnabled": true } }, { "Action": { "Block": {} }, "Name": { "Fn::Sub": "${ParentStackName}BlacklistRule" }, "Priority": 1, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFBlacklistSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFBlacklistSetV6", "Arn" ] } } } ] } }, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "BlacklistRule" ] ] }, "SampledRequestsEnabled": true } }, { "Fn::If": [ "HttpFloodProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}HttpFloodRegularRule" }, "Priority": 18, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "HttpFloodRegularRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFHttpFloodSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFHttpFloodSetV6", "Arn" ] } } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "HttpFloodProtectionRateBasedRuleActivated", { "Name": { "Fn::Sub": "${ParentStackName}HttpFloodRateBasedRule" }, "Priority": 19, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "HttpFloodRateBasedRule" ] ] } }, "Statement": { "RateBasedStatement": { "AggregateKeyType": { "Fn::If": [ "IsDefaultIP", "IP", "CUSTOM_KEYS" ] }, "CustomKeys": { "Fn::If": [ "IsDefaultIP", { "Ref": "AWS::NoValue" }, { "Fn::If": [ "IsCustomHeaderSelected", [ { "Header": { "Name": { "Ref": "CustomHeaderNameParam" }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } }, { "IP": {} } ], { "Fn::If": [ "IsUriPathSelected", [ { "UriPath": { "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } }, { "IP": {} } ], { "Fn::If": [ "IsHttpMethodSelected", [ { "HTTPMethod": {} }, { "IP": {} } ], { "Ref": "AWS::NoValue" } ] } ] } ] } ] }, "EvaluationWindowSec": { "Fn::FindInMap": [ "TimeWindowMap", { "Ref": "TimeWindowThresholdParam" }, "seconds" ] }, "Limit": { "Ref": "RequestThreshold" } } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "ScannersProbesProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}ScannersAndProbesRule" }, "Priority": 17, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "ScannersProbesRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFScannersProbesSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFScannersProbesSetV6", "Arn" ] } } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "ReputationListsProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}IPReputationListsRule" }, "Priority": 3, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "IPReputationListsRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFReputationListsSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFReputationListsSetV6", "Arn" ] } } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "BadBotProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}BadBotRule" }, "Priority": 5, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "BadBotRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFBadBotSetV4", "Arn" ] } } }, { "IPSetReferenceStatement": { "Arn": { "Fn::GetAtt": [ "WAFBadBotSetV6", "Arn" ] } } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "SqlInjectionProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}SqlInjectionRule" }, "Priority": 15, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "SqlInjectionRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "SqliMatchStatement": { "FieldToMatch": { "QueryString": {} }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ], "SensitivityLevel": { "Ref": "SqlInjectionProtectionSensitivityLevelParam" } } }, { "SqliMatchStatement": { "FieldToMatch": { "Body": { "OversizeHandling": { "Fn::If": [ "SqlInjectionProtectionContinueActivated", "CONTINUE", { "Fn::If": [ "SqlInjectionProtectionMatchActivated", "MATCH", { "Fn::If": [ "SqlInjectionProtectionNoMatchActivated", "NO_MATCH", "CONTINUE" ] } ] } ] } } }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ], "SensitivityLevel": { "Ref": "SqlInjectionProtectionSensitivityLevelParam" } } }, { "SqliMatchStatement": { "FieldToMatch": { "UriPath": {} }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ], "SensitivityLevel": { "Ref": "SqlInjectionProtectionSensitivityLevelParam" } } }, { "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "authorization" } }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ], "SensitivityLevel": { "Ref": "SqlInjectionProtectionSensitivityLevelParam" } } }, { "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "cookie" } }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ], "SensitivityLevel": { "Ref": "SqlInjectionProtectionSensitivityLevelParam" } } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "CrossSiteScriptingProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}XssRule" }, "Priority": 16, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "XssRule" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "XssMatchStatement": { "FieldToMatch": { "QueryString": {} }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } }, { "XssMatchStatement": { "FieldToMatch": { "Body": { "OversizeHandling": { "Fn::If": [ "CrossSiteScriptingProtectionContinueActivated", "CONTINUE", { "Fn::If": [ "CrossSiteScriptingProtectionMatchActivated", "MATCH", { "Fn::If": [ "CrossSiteScriptingProtectionNoMatchActivated", "NO_MATCH", "CONTINUE" ] } ] } ] } } }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } }, { "XssMatchStatement": { "FieldToMatch": { "UriPath": {} }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } }, { "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "cookie" } }, "TextTransformations": [ { "Priority": 1, "Type": "URL_DECODE" }, { "Priority": 2, "Type": "HTML_ENTITY_DECODE" } ] } } ] } } }, { "Ref": "AWS::NoValue" } ] }, { "Fn::If": [ "BadBotProtectionActivated", { "Name": { "Fn::Sub": "${ParentStackName}BadBotRuleFilter" }, "Priority": 20, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "BadBotRuleFilter" ] ] } }, "Statement": { "OrStatement": { "Statements": [ { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/ProdStage", "TextTransformations": [ { "Type": "URL_DECODE", "Priority": 0 } ] } }, { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/CFDeploymentStage", "TextTransformations": [ { "Type": "URL_DECODE", "Priority": 0 } ] } } ] } }, "RuleLabels": [ { "Name": "badbot" } ] }, { "Ref": "AWS::NoValue" } ] } ], "Scope": { "Fn::Sub": "${RegionScope}" }, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "WAFWebACL" ] ] }, "SampledRequestsEnabled": true } } } }, "Outputs": { "WAFWhitelistSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFWhitelistSetV4", "Arn" ] } }, "WAFBlacklistSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFBlacklistSetV4", "Arn" ] } }, "WAFHttpFloodSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFHttpFloodSetV4", "Arn" ] }, "Condition": "HttpFloodProtectionActivated" }, "WAFScannersProbesSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFScannersProbesSetV4", "Arn" ] }, "Condition": "ScannersProbesProtectionActivated" }, "WAFReputationListsSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFReputationListsSetV4", "Arn" ] }, "Condition": "ReputationListsProtectionActivated" }, "WAFBadBotSetV4Arn": { "Value": { "Fn::GetAtt": [ "WAFBadBotSetV4", "Arn" ] }, "Condition": "BadBotProtectionActivated" }, "WAFWhitelistSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFWhitelistSetV6", "Arn" ] } }, "WAFBlacklistSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFBlacklistSetV6", "Arn" ] } }, "WAFHttpFloodSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFHttpFloodSetV6", "Arn" ] }, "Condition": "HttpFloodProtectionActivated" }, "WAFScannersProbesSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFScannersProbesSetV6", "Arn" ] }, "Condition": "ScannersProbesProtectionActivated" }, "WAFReputationListsSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFReputationListsSetV6", "Arn" ] }, "Condition": "ReputationListsProtectionActivated" }, "WAFBadBotSetV6Arn": { "Value": { "Fn::GetAtt": [ "WAFBadBotSetV6", "Arn" ] }, "Condition": "BadBotProtectionActivated" }, "NameWAFWhitelistSetV4": { "Value": { "Fn::Sub": "${ParentStackName}WhitelistSetIPV4" } }, "NameWAFBlacklistSetV4": { "Value": { "Fn::Sub": "${ParentStackName}BlacklistSetIPV4" } }, "NameHttpFloodSetV4": { "Value": { "Fn::Sub": "${ParentStackName}HTTPFloodSetIPV4" }, "Condition": "HttpFloodProtectionActivated" }, "NameScannersProbesSetV4": { "Value": { "Fn::Sub": "${ParentStackName}ScannersProbesSetIPV4" }, "Condition": "ScannersProbesProtectionActivated" }, "NameReputationListsSetV4": { "Value": { "Fn::Sub": "${ParentStackName}IPReputationListsSetIPV4" }, "Condition": "ReputationListsProtectionActivated" }, "NameBadBotSetV4": { "Value": { "Fn::Sub": "${ParentStackName}IPBadBotSetIPV4" }, "Condition": "BadBotProtectionActivated" }, "NameWAFWhitelistSetV6": { "Value": { "Fn::Sub": "${ParentStackName}WhitelistSetIPV6" } }, "NameWAFBlacklistSetV6": { "Value": { "Fn::Sub": "${ParentStackName}BlacklistSetIPV6" } }, "NameHttpFloodSetV6": { "Value": { "Fn::Sub": "${ParentStackName}HTTPFloodSetIPV6" }, "Condition": "HttpFloodProtectionActivated" }, "NameScannersProbesSetV6": { "Value": { "Fn::Sub": "${ParentStackName}ScannersProbesSetIPV6" }, "Condition": "ScannersProbesProtectionActivated" }, "NameReputationListsSetV6": { "Value": { "Fn::Sub": "${ParentStackName}IPReputationListsSetIPV6" }, "Condition": "ReputationListsProtectionActivated" }, "NameBadBotSetV6": { "Value": { "Fn::Sub": "${ParentStackName}IPBadBotSetIPV6" }, "Condition": "BadBotProtectionActivated" }, "GlueAccessLogsDatabase": { "Value": { "Ref": "GlueAccessLogsDatabase" } }, "GlueAppAccessLogsTable": { "Value": { "Ref": "GlueAppAccessLogsTable" } }, "GlueWafAccessLogsTable": { "Value": { "Ref": "GlueWafAccessLogsTable" } }, "WAFWebACL": { "Value": { "Ref": "WAFWebACL" } }, "WAFWebACLArn": { "Value": { "Fn::GetAtt": [ "WAFWebACL", "Arn" ] } }, "WAFWebACLMetricName": { "Value": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "MaliciousRequesters" ] ] } }, "IPReputationListsMetricName": { "Value": { "Fn::Join": [ "", [ { "Fn::Join": [ "", { "Fn::Split": [ "-", { "Ref": "ParentStackName" } ] } ] }, "IPReputationListsRule" ] ] } }, "Version": { "Value": "v4.1.4" }, "WAFWhitelistSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFWhitelistSetV4", "Id" ] } }, "WAFBlacklistSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFBlacklistSetV4", "Id" ] } }, "WAFHttpFloodSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFHttpFloodSetV4", "Id" ] }, "Condition": "HttpFloodProtectionActivated" }, "WAFScannersProbesSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFScannersProbesSetV4", "Id" ] }, "Condition": "ScannersProbesProtectionActivated" }, "WAFReputationListsSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFReputationListsSetV4", "Id" ] }, "Condition": "ReputationListsProtectionActivated" }, "WAFBadBotSetV4Id": { "Value": { "Fn::GetAtt": [ "WAFBadBotSetV4", "Id" ] }, "Condition": "BadBotProtectionActivated" }, "WAFWhitelistSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFWhitelistSetV6", "Id" ] } }, "WAFBlacklistSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFBlacklistSetV6", "Id" ] } }, "WAFHttpFloodSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFHttpFloodSetV6", "Id" ] }, "Condition": "HttpFloodProtectionActivated" }, "WAFScannersProbesSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFScannersProbesSetV6", "Id" ] }, "Condition": "ScannersProbesProtectionActivated" }, "WAFReputationListsSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFReputationListsSetV6", "Id" ] }, "Condition": "ReputationListsProtectionActivated" }, "WAFBadBotSetV6Id": { "Value": { "Fn::GetAtt": [ "WAFBadBotSetV6", "Id" ] }, "Condition": "BadBotProtectionActivated" }, "CustomTimerFunctionName": { "Value": { "Ref": "CustomTimer" } } } }