waf-automations-cdk

Usage

const wafAutomations = new WafSecurityAutomations(this, 'waf-security-automations', {
    stackName: 'waf-security-automations',
    accessLogBucket: myLogBucket,
    options: {
        // See below
    },
});

// Can now use the following:
wafAutomations.webAclName  // string, the name of the created webAcl, will match stackName due to implementation of the cfn template
wafAutomations.webAclArn  // string, arn of the created webAcl, pass this to a Cloudfront distribution
wafAutomations.webAclId   // string
wafAutomations.webAclDescription  // string

This creates a WAFv2 WebACL named matching the stackName.

Options

All are optional

| Attribute | Default | Description | | --------- | ------- | ----------- | | templateVersion | 'v3.1.0' | See releases. | | activateSqlInjectionProtection | true | Enables the component designed to block common SQL injection attacks | | activateCrossSiteScriptingProtection | true | Enables the component designed to block common XSS attacks | | activateHttpFloodProtection | true | Enables the component designed to block HTTP flood attacks | | httpFloodProtectionMethod | 'waf' | Alternatives: 'lambda' or 'athena' | | activateScannersProbesProtection | true | Enables the component designed to block scanners and probes | | scannersProbesProtectionMethod | 'lambda' | Alternative: 'athena' | | activateReputationListsProtection | true | Enable to block requests from IP addresses on third-party reputation lists (supported lists: spamhaus, torproject, and emergingthreats). | | activateBadBotProtection | true | Enables the component designed to block bad bots and content scrapers | | endpointType | 'cloudfront' | Select the type of resource being used, alternative: 'alb' (Note, see https://github.com/isotoma/waf-automations-cdk/issues/14) | | errorThresholdPerMinute | 50 | If activateScannersProbesProtection is enabled, enter the maximum acceptable bad requests per minute per IP. | | requestThresholdPerFiveMinutes | 100 | If activateHttpFloodProtection is enabled, enter the maximum acceptable requests per FIVE-minute period per IP address. >=100 if using WAF, >0 if Lambda or Athena. | | wafBlockPeriodMinutes | 240 | If activateScannersProbesProtection or activateHttpFloodProtection is enabled, enter the period (in minutes) to block applicable IP addresses. | | keepDataInOriginalS3Location | false | By default log files will be moved from their original location to a partitioned folder structure in s3. Set to true to copy instead. |

Development

Releasing a new version

Run

$ npm version (patch|minor|major)
$ git push origin main [tag you just created]