AWS Security Cookbook

How it works...

A web ACL is the primary component within AWS WAF. A web ACL contains one or more rules. Rules contain conditional statements (for example, block access from a range of IP addresses). We added our own rule using the rule builder. The rule builder has an IF part and a THEN part. The IF part contains the condition, while the THEN part contains the action that needs to be taken when the condition in the IF part is satisfied. In this recipe, we added a simple rule that checks if the query string contains a string, badstring, and blocks such requests.

In the IF part, we can currently inspect the following request components: Header, Single query parameter, All query parameters, URI path, Query string, Body, and HTTP method.