Web Application Security

Applying security within AWS requires a layered approach, one of those layers can be centered around your web application infrastructure. Ensuring you implement controls and safeguards against your web applications is essential. By their very nature, they are external facing to the open public and with that comes additional threats and risks. As soon as your services are made available to the public, it will not be long before someone, somewhere will be trying to access your data and application in a malicious and harmful way. This chapter will focus on some of the methods and techniques that can be used to help mitigate such threats and exposures.

The following topics will be covered in this chapter:

• AWS web application firewall (WAF)
• AWS Shield
• AWS Firewall Manager

Technical requirements

To gain the most from this chapter you should have some knowledge or experience with using the following services:

• Amazon CloudFront
• Application Load Balancer
• Familiarity of the OSI model

Within this chapter I will be covering the following services and explaining what they are and what they are used for:

• AWS WAF
• AWS Shield
• AWS Firewall Manager
• Amazon CloudFront security features

AWS web application firewall

AWS WAF works closely with Amazon CloudFront and Application Load Balancers (ALBs) and its primary function is to prevent your web applications from being subjected to intrusion by common attack patterns. By working in conjunction with CloudFront distributions and ALBs, AWS WAF can dictate how these services respond to web requests based on preconfigured conditions. This allows all HTTP and HTTPS requests to be filtered and identified as genuine or damaging inbound requests which are then either allowed or blocked as required.

There are three main component of the AWS WAF service in how it configured to help protect your web applications, these components are comprised of the following:

• Conditions
• Rules
• Web access control lists (ACLs)

Each of these is configured in order, you must first start with configuring conditions, which are then added to your...

AWS Shield

AWS Shield is accessed from within the same dashboard as AWS WAF and again is used to protect your web application infrastructure. AWS Shield is used to protect your infrastructure from Distributed Denial of Service (DDoS) attacks. There are different types of DDoS attacks, but the end goal is always the same, to significantly impact the performance and ability of the targeted web servers. This strain on resources prevents any genuine web request from being processed by your infrastructure due to the effort required to process the bad requests. This performance hit can be so severe that your website or application can appear to be offline.

DDoS

There are different types of DDoS attacks which AWS Shield can mitigate...

AWS Firewall Manager

The AWS Firewall Manager is an extremely useful tool if you are using AWS Organizations and multiple AWS accounts. In fact, without configuring AWS Organizations you are unable to use the feature at all.

AWS Firewall Manager has been designed to help you manage, control and implement your AWS WAF rules across the whole AWS Organization with ease and simplicity. Once you have set up your AWS WAF rules using the conditions that you define, they can then be deployed and used within other AWS accounts within your organization without having to recreate them in each account. Any new resources that are created that need to be protected will automatically be safeguarded via the AWS Firewall Manager. For example, you might create additional CloudFront distributions in your existing accounts, or even if a new account is created within your organization with a new...

Summary

Security threats to web application and infrastructure have and always will be a concern for the organization who provide public-facing services. Unfortunately, you have to prepare for those who are determined to breach your security defenses and take advantage of any weaknesses that may exist within your infrastructure. AWS has a number of Security services that help you to control and manage these inevitable attacks, in this chapter we discussed AWS WAF, AWS Shield, AWS Firewall Manager, and some of the CloudFront security features. Although some of these services come at an additional cost, this cost is negligible when it comes to comparing it against the cost of compromised data and resources within your business. Not just a financial cost, but reputational cost which can unintentionally adversely affect your business going forward.

...

Further reading

• Secure Content Delivery with Amazon CloudFront: https://d1.awsstatic.com/whitepapers/Security/Secure_content_delivery_with_CloudFront_whitepaper.pdf
• Using WAF to mitigate OWASP's to 10 Web Application Vulnerabilities: https://d1.awsstatic.com/whitepapers/Security/aws-waf-owasp.pdf