- Hello, my name is Harith.
I'm a Senior Edge Specialist Solutions Architect
at Amazon Web Services.
Welcome to a short talk on AWS WAF managed rules.
This widely used feature is a pride and joy
for us and our customers.
What I would like to tell you here today
is what is this feature,
how to configure AWS WAF managed rules,
and finally show you how to begin using them.
Before we get started, I would like to talk about AWS WAF.
AWS WAF stands for AWS Web Application Firewall.
This is our cloud-native firewall that operates
by monitoring and blocking http-based communications
based on the layer 7 rules that our customers configure.
It runs with different integration points
and our customers love to use this service
to protect their applications
from a variety of layer 7 attacks
and also perform intelligent threat mitigation.
AWS managed rules work with AWS WAF.
AWS managed rule groups are a collection of predefined,
ready to use rules that AWS and its marketplace sellers
offer for our customers.
In this video, I'll be talking about benefits
of AWS WAF managed rules and also how to configure them.
But feel free to check out
our marketplace managed rule groups too.
They are available by subscription through AWS Marketplace.
I'll go ahead and talk about some of my favorite features
with AWS WAF managed rules.
Automatic updates.
Keeping up to date
on the constantly changing threat landscape
can be time-consuming and expensive.
Managed rule groups can save customers
this time and money when you implement
and start working with AWS WAF.
AWS and its marketplace sellers
automatically update these managed rule groups
and provide newer versions of rule groups
when new threats emerge.
Zero day protection.
In some cases, AWS, due to its participation
in a number of private disclosure communities,
can update these AWS WAF managed rule groups
and deploy them for our customers
before a threat is widely known,
so thereby offering zero day protection.
Restricted access.
To protect the intellectual property
of the rule group providers,
including AWS WAF managed rules,
customers cannot view the details of the individual rules
within the rule group.
Having this restricted access
keeps malicious users from designing threats
that specifically circumvent these published rules.
However, AWS does describe what each rule does
and the value add for each managed rule group
to your backend configuration.
Versioning.
A managed rule group provider updates a rule group
and gives options to maintain different versions.
Customers get to choose a specific version
of a particular rule group.
Occasionally, when a provider might have to update
a new version of a particular rule group,
customers are given a choice to opt in
for their favorite version or their preferred version.
Let's take a look at available managed rule groups.
Baseline managed rule groups.
These rule groups provide general protection
against a wide variety of common threats.
For instance, the core rule set managed rule group
contains rules that are generally applicable
to web applications and provides protections
against exploitation of a wide range of vulnerabilities
and commonly occurring vulnerabilities
that are described in OS publications.
The use-case specific rule groups
provide incremental protection
for many diverse AWS WAF use cases.
Depending upon your workload being protected,
you can choose one or more of these rule groups.
The IP reputation list rule groups, you know,
allow you to block requests
based on the source IP and reputation.
For example, the Amazon IP reputation list
is a compilation of IPs detected on Amazon network
that are deemed highly likely to be malicious.
Other than these three categories,
we do offer additional threat mitigation capabilities
using AWS WAF bot control and account takeover protection.
There will be separate videos in this series
that will be describing them in detail.
Let's get started.
I'll quickly show you how to add
an AWS WAF managed rule group to an existing web ACL
using AWS WAF console.
To add a managed rule group
to a web ACL through the console,
first sign into AWS management console
and open the AWS WAF console.
You begin by choosing web ACLs
in the navigation pane.
In the web ACLs page from the list of web ACLS
select the one that you want to add the rule group to.
This takes you to the page for the single web ACL.
In your web ACL page, choose the rule step.
In the rules pane, choose add rules,
and then choose, add managed rule groups.
In the add managed rule groups page
expand the selection for your rule group vendor
to see a list of available rule groups
For each rule group that you want to add,
choose add to web ACL.
If you want to make changes
to the web ACL configuration of the rule group,
choose edit, make your changes, and then choose save group.
At the bottom of your add managed rule groups page
choose add rules to proceed further.
In the set rule priority page are just the order
that the rules have to run as needed.
Then choose save.
Now that you've seen how to add this to your web ACL,
you could do something similar using AWS CLI or AWS APIs.
AWS managed rules are designed to protect you
from common web threats,
When used in accordance
with our best practices and documentation,
AWS managed rules add another layer of security
for your applications.
However, AWS managed rules are not intended
as a replacement for your security responsibilities,
which are determined by the AWS resources that you select.
Please refer to shared responsibility model to ensure
that your resources in AWS are properly protected.
Hope this information will help you get started
with AWS managed rules.
And I would recommend going through our documentation
for further reading.
Thanks for your time,
and happy cloud computing from all of us at AWS.