This document will provide detailed instructions and a step-by-step process to setup and configure a WAF for AWS using a Virtual Private Cloud (VPC) and an Application Load Balancer (ALB).

Configuring AWS WAF with an ALB in a VPC

Phase 1: Prerequisites in your VPC

1. Ensure your VPC is configured: You need a VPC with at least two public subnets (for an internet-facing ALB) and private subnets (for your application servers).
2. Deploy your Application: Host your application on EC2, ECS, or EKS within the private subnets.
3. Create an Application Load Balancer (ALB):
   • Navigate to the EC2 Dashboard -> Load Balancers.
   • Create an ALB in your public subnets.
   • Configure a Target Group pointing to your application instances in the private subnets.
   • Ensure the ALB Security Group allows inbound web traffic (Port 80/443).

Phase 2: Creating and Configuring the AWS WAF Web ACL

1. Open the AWS WAF Console: Navigate to WAF & Shield in the AWS Management Console.
2. Create a Web ACL:
   • Click Create web ACL.
   • Name: Give your Web ACL a descriptive name.
   • Resource type: Select Regional resources (since ALBs are regional, unlike CloudFront which is global).
   • Region: Select the AWS Region where your VPC and ALB are located.
3. Associate AWS resources:
   • Click Add AWS resources.
   • Select Application Load Balancer, choose the ALB you created in Phase 1, and click Add.
4. Add Rules and Rule Groups:
   • Under "Add rules and rule groups", click Add rules.
   • Managed rules: AWS provides pre-configured rule groups. It is highly recommended to start with the AWS Managed Rules (e.g., Core rule set, Known bad inputs, Amazon IP reputation list).
   • Custom rules: You can create custom rules to block specific IP addresses, rate-limit requests (to prevent DDoS/brute force), or block specific geographic locations.
5. Set Default Action:
   • Choose what to do with requests that don't match any rules. Typically, this is set to Allow.
6. Set Rule Priority:
   • If you added multiple rules, order them. AWS evaluates rules from top to bottom. (e.g., Put IP blocklists at the top).
7. Configure Metrics and Logging:
   • Enable Amazon CloudWatch metrics.
   • Crucial for enterprise environments: Enable Logging and select an Amazon S3 bucket, CloudWatch Logs group, or Kinesis Data Firehose. (Note: NASA environments likely have a designated centralized logging bucket or SIEM destination you must use).

Phase 3: Testing and Deployment

1. Start in "Count" Mode: When you first add rules (especially Managed Rules), set their action to Count instead of Block. This allows you to review the logs to ensure legitimate traffic isn't being blocked (false positives).
2. Review Logs: Monitor the WAF logs via CloudWatch or Athena (if using S3).
3. Switch to "Block": Once you are confident the rules are only catching malicious traffic, edit the Web ACL and change the rule actions from Count to Block.