Project: KICS (Provisioning / Security & Compliance)
File: 105ba098-1e34-48cd-b0f2-a8a43a51bf9b.md

title: ALB Is Not Integrated With WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 105ba098-1e34-48cd-b0f2-a8a43a51bf9b Query name: ALB Is Not Integrated With WAF Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) service<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: MyLoadBalancer22: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: "80" InstanceProtocol: HTTP LoadBalancerPort: "443" Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate Scheme: internet-facing ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: MyLoadBalancerV2: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: myloadbalancerv2 Scheme: internet-facing ``` ```json title="Positive test num. 3 - json file" hl_lines="4" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyLoadBalancer22222222": { "Properties": { "Listeners": [ { "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ] } ], "Scheme": "internet-facing", "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true }, "Type": "AWS::ElasticLoadBalancing::LoadBalancer" } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="4" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyLoadBalancerV22222": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "Scheme": "internet-facing", "Name": "myloadbalancerv2" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: MyLoadBalancer9: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '443' Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate Scheme: internet-facing MyWebACLAssociation: Type: "AWS::WAFRegional::WebACLAssociation" Properties: ResourceArn: Ref: MyLoadBalancer9 WebACLId: Ref: MyWebACL ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyLoadBalancer8": { "Properties": { "Listeners": [ { "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS" } ], "Scheme": "internet-facing", "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true }, "Type": "AWS::ElasticLoadBalancing::LoadBalancer" }, "MyWebACLAssociation": { "Type": "AWS::WAFRegional::WebACLAssociation", "Properties": { "WebACLId": { "Ref": "MyWebACL" }, "ResourceArn": { "Ref": "MyLoadBalancer8" } } } } } ```