Trying Out Various Settings for AWS WAF Publishing
Tags: awswaf, waf, cloudfront, s3
Published: 2022-01-31 11:11:27

![img](https://day-journal.com/memo/images/logo/aws/waf.png)

### I've been experimenting with various settings for AWS WAF publishing :tada:  

<br>

Advance Preparation

- Publishing with Amazon CloudFront and Amazon S3

[Trying Out Various Settings for Amazon CloudFront Publishing - Publishing in combination with Amazon S3](https://dev.to/aws-builders/trying-out-various-settings-for-amazon-cloudfront-publishing-28pp)

<br>

## Publishing with Amazon CloudFront

This is a method of publishing using a combination of AWS WAF and Amazon CloudFront.

AWS Console → Click “WAF & Shield.”
![img](https://day-journal.com/memo/images/aws-waf-001_01.png)

Click "Create web ACL."
![img](https://day-journal.com/memo/images/aws-waf-001_02.png)

Set an arbitrary name. Select CloudFront as the resource type. Select the target CloudFront distribution. Leave the other settings as default this time.
![img](https://day-journal.com/memo/images/aws-waf-001_03.png)
![img](https://day-journal.com/memo/images/aws-waf-001_04.png)
![img](https://day-journal.com/memo/images/aws-waf-001_05.png)
![img](https://day-journal.com/memo/images/aws-waf-001_06.png)

Confirm the settings → Click “Create web ACL.”
![img](https://day-journal.com/memo/images/aws-waf-001_07.png)

Click on the Web ACL that has been created.
![img](https://day-journal.com/memo/images/aws-waf-001_08.png)

You can check the details of the Web ACL.
![img](https://day-journal.com/memo/images/aws-waf-001_09.png)

<br>

## Publishing only the specified IP

This is a method for publishing only the specified IP in AWS WAF. 

As preliminary preparation, configure the Web ACL.

Click "IP sets."
![img](https://day-journal.com/memo/images/aws-waf-002_01.png)

Click "Create IP set."
![img](https://day-journal.com/memo/images/aws-waf-002_02.png)

Set an arbitrary name. Select CloudFront as the region, and select IPv4. Set the target IP address. → Click "Create IP set."
![img](https://day-journal.com/memo/images/aws-waf-002_03.png)

Click on the IP settings that has been created.
![img](https://day-journal.com/memo/images/aws-waf-002_04.png)

You can check the details of the IP settings.
![img](https://day-journal.com/memo/images/aws-waf-002_05.png)

Click "Web ACLs" → Click the target Web ACL.
![img](https://day-journal.com/memo/images/aws-waf-003_01.png)

Click "Rules" → Click "Add rules" → Click "Add my own rules and rule groups."
![img](https://day-journal.com/memo/images/aws-waf-003_02.png)

Select "IP set." Set an arbitrary name, select the IP setting configured in the IP set, select the Source IP address, set "Allow" in "Action," and click "Add Rule."
![img](https://day-journal.com/memo/images/aws-waf-003_03.png)

Click "Save," and you will see the rules are set. Next, click "Edit" for the default rule.
![img](https://day-journal.com/memo/images/aws-waf-003_04.png)
![img](https://day-journal.com/memo/images/aws-waf-003_05.png)

Select Block as the Default action, set 403 as the Response code, and click "Save."
![img](https://day-journal.com/memo/images/aws-waf-003_06.png)

Confirm that the settings have been made.
![img](https://day-journal.com/memo/images/aws-waf-003_07.png)

If you access the URL from the IP you set, the WebSite will be displayed. WebSite will not be displayed except for the specified IP.
![img](https://day-journal.com/memo/images/aws-waf-003_08.png)

<br>

## Basic authentication public

This is the method to publish with Basic authentication in AWS WAF.

As preliminary preparation, configure the Web ACL.

Click "Web ACLs" → Click the target Web ACL.
![img](https://day-journal.com/memo/images/aws-waf-004_01.png)

Click "Rules" → Click "Add rules" → Click "Add my own rules and rule groups."
![img](https://day-journal.com/memo/images/aws-waf-004_02.png)

Select "Rule builder." Set an arbitrary name. Select "Regular rule" for the type, set "Statement" to the captured content, set the value of the user name and password converted to the base64 in “String to Match,” set "Block" for the Action, set "Custom response" to the captured content, and click "Add rule."
![img](https://day-journal.com/memo/images/aws-waf-004_03.png)
![img](https://day-journal.com/memo/images/aws-waf-004_04.png)

Click "Save".
![img](https://day-journal.com/memo/images/aws-waf-004_05.png)

Click on the created rule.
![img](https://day-journal.com/memo/images/aws-waf-004_06.png)

You can see the details of the rule.
![img](https://day-journal.com/memo/images/aws-waf-004_07.png)

When you access the URL, a dialog for entering the user and password will appear.
![img](https://day-journal.com/memo/images/aws-waf-004_08.png)

When enter the configured user and password, the WebSite will be displayed.

<br>

## Request Restriction

This is how to restrict requests with AWS WAF. 

As preliminary preparation, configure the Web ACL.

Click "Web ACLs" → Click the target Web ACL.
![img](https://day-journal.com/memo/images/aws-waf-005_01.png)

Click "Rules" → Click "Add rules" → Click "Add my own rules and rule groups."
![img](https://day-journal.com/memo/images/aws-waf-005_02.png)

Select "Rule builder." Set an arbitrary name. Select "Rate based rule" as the type, set the rate limit to 100 in the Request rate details, set Block as the Action, and click "Add rule."
![img](https://day-journal.com/memo/images/aws-waf-005_03.png)

Click "Save".
![img](https://day-journal.com/memo/images/aws-waf-005_04.png)

Click on the rule that has been created.
![img](https://day-journal.com/memo/images/aws-waf-005_05.png)

You can see the rule details.
![img](https://day-journal.com/memo/images/aws-waf-005_06.png)

Try to access the site dynamically at least 100 times within 5 minutes.
![img](https://day-journal.com/memo/images/aws-waf-005_07.png)

If there are more than the specified number of accesses in 5 minutes, it will be blocked. When the number of accesses is less than the set number, the access is allowed.
![img](https://day-journal.com/memo/images/aws-waf-005_08.png)

<br>

By using AWS WAF, it is possible to publish in combination with Amazon CloudFront and configure various settings other than the IP restrictions, basic authentication, and request restrictions that we tried this time :bulb: 

In my next article, I would like to introduce the way combined with Amazon Route 53.

<br>

Related Articles

{% link https://dev.to/aws-builders/trying-out-various-settings-for-amazon-cloudfront-publishing-28pp %}
{% link https://dev.to/aws-builders/trying-out-various-settings-for-amazon-s3-publishing-2hd1 %}