Create an Amazon API Gateway integration with AWS WAF
This pattern in CDK offers a example to generate an Amazon API Gateway with a greedy proxy (“{proxy+}”) and “ANY” method from the specified path.
This means it will accept by default any method and any path. The Lambda function is configured for VPC access and returns only the path.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 | import { CfnWebACL, CfnWebACLAssociation } from '@aws-cdk/aws-wafv2'; import * as cdk from "@aws-cdk/core"; export class WafStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string) { super(scope, id); // const CustomHeader = new cdk.CfnParameter(this, "CustomHeader", { // type: "String", // default: "x-key" // }); //Web ACL const APIGatewayWebACL = new CfnWebACL(this, "APIGatewayWebACL", { name: "demo-api-gateway-webacl", description: "This is WebACL for Auth APi Gateway", scope: "REGIONAL", defaultAction: { block: {} }, visibilityConfig: { metricName: "demo-APIWebACL", cloudWatchMetricsEnabled: true, sampledRequestsEnabled: true }, rules: [ { name: "demo-rateLimitRule", priority: 20, action: { block: {} }, visibilityConfig: { metricName: "demo-rateLimitRule", cloudWatchMetricsEnabled: true, sampledRequestsEnabled: false }, statement: { rateBasedStatement: { aggregateKeyType: "IP", limit: 100 } } }, { name: `demo-api-auth-gateway-geolocation-rule`, priority: 30, action: { allow: {} }, visibilityConfig: { metricName: `demo-AuthAPIGeoLocationUS`, cloudWatchMetricsEnabled: true, sampledRequestsEnabled: false }, statement: { geoMatchStatement: { countryCodes: ['US'] } } }, { name: `demo-api-auth-gateway-sqli-rule`, priority: 40, action: { block: {} }, visibilityConfig: { metricName: `demo-APIAuthGatewaySqliRule`, cloudWatchMetricsEnabled: true, sampledRequestsEnabled: false }, statement: { orStatement: { statements: [{ sqliMatchStatement: { fieldToMatch: { allQueryArguments: {} }, textTransformations: [{ priority: 1, type: "URL_DECODE" }, { priority: 2, type: "HTML_ENTITY_DECODE" }] } }, { sqliMatchStatement: { fieldToMatch: { body: {} }, textTransformations: [{ priority: 1, type: "URL_DECODE" }, { priority: 2, type: "HTML_ENTITY_DECODE" }] } }, { sqliMatchStatement: { fieldToMatch: { uriPath: {} }, textTransformations: [{ priority: 1, type: "URL_DECODE" }] } }] } } }, { name: `demo-detect-xss`, priority: 60, action: { block: {} }, visibilityConfig: { metricName: `demo-detect-xss`, cloudWatchMetricsEnabled: true, sampledRequestsEnabled: false }, statement: { orStatement: { statements: [ { xssMatchStatement: { fieldToMatch: { uriPath: {} }, textTransformations: [{ priority: 1, type: "URL_DECODE" }, { priority: 2, type: "HTML_ENTITY_DECODE" }] } }, { xssMatchStatement: { fieldToMatch: { allQueryArguments: {} }, textTransformations: [{ priority: 1, type: "URL_DECODE" }, { priority: 2, type: "HTML_ENTITY_DECODE" }] } }, ] } } } ] }); // Web ACL Association // const APIGatewayWebACLAssociation = new CfnWebACLAssociation(this, "APIGatewayWebACLAssociation", { webAclArn: APIGatewayWebACL.attrArn, resourceArn: cdk.Fn.join("", ["arn:aws:apigateway:us-east-1::/restapis/", cdk.Fn.importValue("demorestapiid"), "/stages/prod", ]) }); } } |
Amazon API Gateway integration with WAF
This pattern in CDK offers a example to generate an Amazon API Gateway with a greedy proxy (“{proxy+}”) and “ANY” method from the specified path, meaning it will accept by default any method and any path. The VPC Lambda function provided in JavaScript only returns the path.
Learn more about this pattern at Serverless Land Patterns: https://serverlessland.com/patterns/apigw-waf-cdk
Important: this application uses various AWS services and there are costs associated with these services after the Free Tier usage – please see the AWS Pricing page for details. You are responsible for any AWS costs incurred. No warranty is implied in this example.
Requirements
- Create an AWS account if you do not already have one and log in. The IAM user that you use must have sufficient permissions to make necessary AWS service calls and manage AWS resources.
- AWS CLI installed and configured
- Git Installed
- Node and NPM installed
- AWS Cloud Development Kit (AWS CDK) installed
Deployment Instructions
- Create a new directory, navigate to that directory in a terminal and clone the GitHub repository:12<span class="token function">git</span> clone https://github.com/aws-samples/serverless-patterns
- Change directory to the pattern directory its source code folder:12<span class="token builtin class-name">cd</span> apig-waf/src
- From the command line, use npm to install the development dependencies:12<span class="token function">npm</span> <span class="token function">install</span>
- To deploy from the command line use the following:123npx cdk bootstrap aws://accountnumber/regionnpx cdk deploy --app <span class="token string">'ts-node .'</span> --all
Testing
- Locate WAFAPIGatewayApi.ApiUrl from output printed by cdk, this is the api endpoint to be invoked
In a browser
1 2 3 4 | ```https://<api_id>.execute-api.<region>.amazonaws.com/prod``` You should see: ```Success path: "/"``` |
Cleanup
- From the command line, use the following in the source folder12npx cdk destroy --app <span class="token string">'ts-node .'</span> --all
- Confirm the removal and wait for the resource deletion to complete.