Lecture 227: AWS Web Application Firewall (WAF)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:39
- 来源：Udemy Lecture 30203324
- Slide 数量：8
- 画面切换：01:59、03:38、05:27、06:46、07:56、09:20、10:09
扫描说明
逐条读取了 Udemy 页面中的 258 条英文 Transcript cue，并按时间轴扫描全长约 11:39 的视频。依据 WAF 版本演进、部署对象、Managed Rule、Web ACL、Inspection/Response、XSS、IP/Size、SQLi/Geo/Regex 条件划分为 8 个小节。8 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 从 WAF Classic 到 AWS WAF：Managed Rule、WCU 与 JSON Rule
时间范围：00:00–01:59
总结 / Summary
中文
AWS WAF 于 2015 年推出，2019 年后的新版本称为 AWS WAF，旧版本标为 WAF Classic。新架构引入 AWS Managed Rules，减少自行编写/导入 Rule 的工作；以 Web ACL Capacity Unit（WCU）衡量 Rule 的计算成本；支持 JSON 表达 Rule；还能用 AND、OR、NOT 组合多个 Statement。已有 Classic 配置应迁移到当前 AWS WAF，以获得新的 Rule Model 与管理能力。
English
AWS WAF launched in 2015, and the redesigned service released around 2019 is called AWS WAF while the earlier version is labeled WAF Classic. The current model adds AWS Managed Rules, measures rule-processing cost with Web ACL Capacity Units, supports JSON rule definitions, and combines statements with AND, OR, and NOT logic. Existing Classic configurations should migrate to the current service to use the newer rule and management model.
Transcript
00:00 Hello, and welcome to this lecture.
00:02 Now, in this lecture,
00:06 we'll cover the web application firewall, that is WAF.
00:07 Now, you already understood that
00:11 WAF is one of the networking security service
00:14 that AWS provides, and it protects your applications
00:17 Now, if you look at the history of the WAF,
00:19 it was originally launched in 2015,
00:23 and then, again, AWS released
00:26 the new version of WAF in 2019.
00:29 So, the older version used to be called WAF Classic,
00:32 but now the newer version is called just AWS WAF,
00:35 or web application firewall.
00:37 So, if I talk about the new changes and benefits of
00:41 using the latest WAF,
00:43 it's that AWS also provides manage rules.
00:46 So, you don't have do really import any rule
00:48 or write your rules on your own,
00:50 but you can use AWS manage rules itself.
00:53 So, it is easy and quick to get started.
00:56 Also, there are certain differences,
00:58 in the sense that now the capacity of WAF is decided by
01:02 using the web ACL capacity units, WCU.
01:07 Earlier, then, it was based on the rules,
01:08 irrespective of how many rules are evaluated.
01:11 But now, it is based on the WCU count.
01:14 Also, now you can write these rules
01:16 in the form of JSON document.
01:18 That means you don't really have to use the web UI or APS
01:24 to write the rule, you can just import
01:26 your JSON document there.
01:28 And, finally, one important change, again,
01:30 is that, earlier,
01:32 you couldn't combine multiple rules together,
01:34 but now, with the new WAF,
01:36 you can create logical conditions,
01:38 like A and B, not C kind of combination.
01:42 So, these are all the new things that came with
01:45 the newer WAF,
01:46 so if you're already using the older version of WAF,
01:50 that is WAF classic,
01:51 then AWS always advise you to migrate to the newer version
01:55 of the WAF.
01:56 Okay, so, with that, let's get started.
2. Layer 7 Inspection：按 IP、Header、Body、URI 等条件过滤
时间范围：01:59–03:38
总结 / Summary
中文
AWS WAF 在 Layer 7 检查 HTTP(S) Request，可按 IPv4/IPv6、HTTP Header、Request Body、URI/Query String 与特定 Pattern Allow 或 Block。Web ACL 可直接关联 CloudFront、Application Load Balancer、API Gateway、AppSync 等受支持资源，无需另建 Reverse Proxy、单独更改 DNS，或为 WAF 部署 Software Appliance。WAF 与资源集成后，Request 在进入 Application 前被评估。
English
AWS WAF inspects HTTP(S) requests at Layer 7 and can allow or block based on IPv4 or IPv6 addresses, HTTP headers, request bodies, URIs, query strings, and defined patterns. A web ACL associates directly with supported resources such as CloudFront, Application Load Balancer, API Gateway, and AppSync, without deploying a reverse proxy, changing DNS solely for WAF, or running a software appliance. Requests are evaluated before reaching the application.
Transcript
01:59 As I said, AWS WAF protects you from layer seven attacks.
02:03 Now, these attacks would typically have various categories.
02:07 Now, very first thing is you can decide
02:11 which IP is to whitelist and which IP is to blacklist,
02:14 so you can keep on updating also this list,
02:17 so WAF will block that traffic or only allow that traffic.
02:22 Then, you can also filter the traffic
02:24 based on a lot of things;
02:26 it's not just about the IP addresses,
02:28 but whatever packet is coming, if it's an HTTP traffic,
02:31 you can look at the HTTP headers as well,
02:34 or HTTP request body as well, or HTTP URL as well.
02:38 And, based on the patterns that you define,
02:41 you can filter that traffic,
02:43 and you can say, "I want to block this traffic
02:46 "if I see a particular string in that URL string," right?
02:52 So, that is all WAF can do.
02:54 Now, AWS WAF is really very easy to deploy.
02:57 And then, of course, you can deploy it on CloudFront
03:01 or Application Load Balancer, or API Gateway,
03:04 or even AppSync, which is a graph QL API.
03:09 And there is no additional software
03:11 to put in front of this AWS services, right?
03:15 You don't have to do any DNS configuration,
03:17 or you don't have to put any SSL or TLS certificates,
03:21 or you don't have to do
03:22 any reverse proxy kind of setup, right?
03:24 It is just enable the WAF,
03:27 and associate that with respect to AWS resources,
03:31 like CloudFront or Load Balancer, or API Gateway,
03:34 and then that's it, right?
03:35 You don't have to do much thereafter.
3. Managed/Marketplace Rule Group 覆盖 OWASP、CVE 与 Bot Flood
时间范围：03:38–05:27
总结 / Summary
中文
可选择 AWS Managed Rule Group 或 AWS Marketplace 中的 Third-party Rule，快速覆盖 OWASP Top 10、常见 CVE、SQL Injection、XSS、Scanner/Probe 与 Bad Bot。Managed Rule Group 由 Provider 更新，新漏洞出现后可通过 Rule Update 获得防护。Rate-based Rule 对聚合键（常见为 Source IP）统计请求速率，超过 Threshold 时临时 Block 或 Count，可抑制单一来源的 Request Flood。
English
AWS Managed Rule Groups and third-party rules from AWS Marketplace provide quick coverage for OWASP Top 10 risks, common CVEs, SQL injection, XSS, scanners or probes, and bad bots. Providers update managed groups as new vulnerabilities emerge. Rate-based rules count request volume by an aggregation key—commonly source IP—and can temporarily block or count traffic that exceeds a threshold, limiting request floods from one source.
Transcript
03:38 And, as I said, with newer WAF,
03:41 AWS also provide manage rules for your WAF,
03:45 and that's where you can just get started
03:47 really very quickly.
03:48 Now, one thing about the WAF is that
03:51 you can select from many rules.
03:53 You can even get the rules from third-party vendors
03:57 on AWS Marketplace,
03:59 but, if you go with the core rules that AWS provide,
04:01 it already takes care of top 10 security risks
04:06 from the OWAS.
04:07 OWAS a web application security project.
04:10 It is a very known top 10 vulnerabilities it covers,
04:14 and then WAF will cover all those vulnerabilities for you.
04:18 But, apart from that,
04:19 it also protects you from
04:21 the emerging common vulnerabilities and exposures,
04:23 we call it CVEs, right?
04:26 Now, benefit of using WAF is that,
04:28 if there is a new CVE detected,
04:30 then that WAF rules will be automatically updated,
04:34 and then you will get the benefit of
04:38 your application being protected from
04:39 the new vulnerabilities that has been
04:41 recently detected, right?
04:43 And you don't have to do anything for that.
04:45 Finally, if there are, say, bots kind of thing,
04:47 which are flooding the traffic to your web application,
04:51 then bot can be detected using the WAF
04:55 by using something called a rate-based rules
04:57 that you can apply.
04:59 Say if particular IP is sending so many requests
05:02 in, say, last five minutes,
05:04 then WAF will block that traffic.
05:07 So, this is all possible with the AWS WAF,
05:11 and that's where it is essential,
05:13 if your application is really very critical and sensitive,
05:17 and you have to make sure it is highly available
05:18 all the time, then it is advisable to use AWS WAF for
05:24 protecting your application from layer seven attacks.
4. Web ACL 由 Rule/Statement 组成，并支持 Rate-based Control
时间范围：05:27–06:46
总结 / Summary
中文
使用 WAF 时先创建 Web ACL，再把按 Priority 排序的 Rule 加入其中。每个 Rule 通过 Statement 描述匹配条件，例如 IP Set、Header、Body、URI、Size Constraint、Country、String 或 Regular Expression；命中后执行 Allow、Block、Count、CAPTCHA/Challenge 等 Action（取决于配置）。Rate-based Rule 按时间窗口聚合 Request Count，适合识别自动化滥用，但应设置合理 Scope-down Statement，避免误伤共享 NAT 后的大量 Legitimate User。
English
To use WAF, create a web ACL and add priority-ordered rules. Each rule uses statements to match conditions such as IP sets, headers, bodies, URIs, size constraints, countries, strings, or regular expressions, then applies an action such as allow, block, count, CAPTCHA, or challenge as configured. Rate-based rules aggregate request counts over a time window; scope-down statements help avoid blocking many legitimate users behind a shared NAT.
Transcript
05:27 Okay, with that, let's look at some of the features
05:30 of the WAF.
05:31 So, as you might have understood,
05:32 it protects web application from common web exploits
05:36 at layer seven.
05:37 It can be deployed in front of
05:39 Application Load Balancer, API Gateway,
05:41 AppSync, or CloudFront.
05:44 Then, in order to use the WAF,
05:45 you have to define something called Web ACL,
05:48 that is Web Access Control List,
05:50 which is nothing but a collection of rules, WAF rules.
05:54 And then you can define conditions in those rules.
05:57 Now, conditions could be like
05:59 I want be inspect IP addresses,
06:00 I want to inspect HTTP headers, HTTP body,
06:04 or URL string, or I want to put size constraint
06:07 that any request can be of this size only,
06:09 I want to avoid or block any other request
06:13 larger than that request,
06:15 and then you want to make sure that
06:17 requests are coming from particular country,
06:19 and then request contains specific string only,
06:23 and you can also match the regular expression
06:25 with your request as well.
06:28 Now, Web ACL also supports rate-based rules.
06:30 As I said, that means it counts the number of requests
06:34 from a particular IP address, and then you can block,
06:36 if one IP is sending, say, hundreds of requests
06:39 in one second, probably that is a bot
06:42 which is trying to do something,
06:44 and then you can block that IP address.
5. Request Body Inspection、HTTP 403 与 Rule Propagation
时间范围：06:46–07:56
总结 / Summary
中文
WAF 可检查 Request Header 与 Body，但 Body Inspection 有 Size Limit。本视频给出的口径是只检查前 8,192 Bytes（8 KB），因此大 Request 超出部分不会按 Body Rule 继续检查；设计时应结合受保护 Service 的实际 Inspection Limit 与 Oversize Handling。Block Action 默认向 Client 返回 HTTP 403 Forbidden，也可按需求自定义 Response。新增或更新 Web ACL Rule 通常会在短时间内传播到关联资源与 CloudFront Edge。
English
WAF can inspect request headers and bodies, but body inspection has a size limit. The lecture uses the first 8,192 bytes (8 KB) as its stated limit, so data beyond that point is not evaluated by a body rule; designs must account for the protected service's actual inspection limit and oversize handling. A block action returns HTTP 403 Forbidden by default, with custom responses available when configured. New or updated rules normally propagate to associated resources and CloudFront edges shortly afterward.
Transcript
06:46 Now, when you evaluate the body of a request, as I said,
06:50 when the request comes, you can look at the HTTP headers
06:52 or HTTP body as well,
06:54 but then, the limitation is, as of now,
06:56 you can only evaluate first 8192 bytes
07:01 out of that request.
07:02 So, if your HTTP request is too large,
07:05 then only first eight KB of the data
07:08 will be looked or inspected for any vulnerabilities.
07:13 Finally, on blocking the malicious traffic,
07:15 WAF returns 403 status score, that is forbidden,
07:18 and we'll also do a demo of this,
07:21 where you see that, when WAF is applied,
07:23 and if it detects some kind of attack,
07:26 for example, cross-site scripting or SQL injection,
07:30 it will give you that kind of error, that is HTTP 403.
07:35 And then, applying WAF rule doesn't take long.
07:38 Within a minute,
07:39 if you write a new rule and add it to Web ACL,
07:42 it will be in the action within one minute.
07:46 And, if you are using CloudFront,
07:48 you know that CloudFront uses eight locations
07:50 across the globe.
07:51 That means your routes will be propagated worldwide
07:54 within that one minute.
6. XSS Match 防止恶意 Script 进入不安全的 Input Path
时间范围：07:56–09:20
总结 / Summary
中文
Cross-Site Scripting（XSS）把恶意 Script 注入未正确验证或编码的 Input，再由浏览器或 Application Context 执行，可能窃取 Cookie、修改页面或执行未授权操作。AWS WAF 的 XSS Match Statement 可检查 Header、Cookie、Query String、URI 与 Body 等 Request Component，并结合 Text Transformation 识别编码后的 Payload。WAF 是补偿性控制，Application 仍应实施 Input Validation 与 Context-aware Output Encoding。
English
Cross-site scripting injects malicious script into an input path that is not correctly validated or encoded, allowing execution in a browser or application context and potentially exposing cookies, changing content, or performing unauthorized actions. AWS WAF XSS match statements inspect components such as headers, cookies, query strings, URIs, and bodies, using text transformations to detect encoded payloads. WAF is a compensating control; applications still need input validation and context-aware output encoding.
Transcript
07:56 Okay, now, let's look at those conditions
07:57 that you can write on the Web ACL more closely,
08:00 like which all attacks can be prevented
08:03 using the Web ACL.
08:05 So, very first thing that you can do is
08:07 you can write a code or a rule
08:09 for protecting your application from cross-site scripting.
08:13 Now, what is cross-sex scripting?
08:15 So, in case of web applications,
08:17 sometimes what attackers can do is,
08:19 whether you insert some fields, for example,
08:22 there is a username or password,
08:24 one can send the script.
08:25 Now, if you heard about the HTML,
08:27 you know the script code is typically executed
08:29 on the server.
08:31 Now, imagine that, in that script,
08:32 someone writes that select star from database.
08:35 No, that is typically an SQL injection,
08:37 but then script could be send an alert, or pop up,
08:40 or display all the cookies of the users,
08:43 anything of that sort, right?
08:46 Now, if your application is not really protected
08:48 by this kind of scripts in the input fields,
08:51 and input fields are not validated well,
08:53 then the script will get executed on the server,
08:56 and then you will get the data
08:59 which is not supposed to be exposed.
09:02 Now, that is a cross-site scripting,
09:03 and we'll also see one example of that as a demo, right?
09:07 So, these cross-site scripting scripts
09:09 can be looked into
09:11 the HTTP methods, or headers, or query string,
09:14 or even the URI, or the HTTP request body.
09:17 So, that's about the cross-site scripting.
7. IP Set 与 Size Constraint 控制来源和 Request Length
时间范围：09:20–10:09
总结 / Summary
中文
IP Set 可保存 IPv4/IPv6 CIDR，用于 Allowlist 或 Blocklist，并能由自动化流程动态更新；相较 SG/NACL，它在 HTTP Layer 与 Web ACL Rule 中组合。Size Constraint Statement 将 Header、Body、URI 等 Component 的大小与阈值比较，拒绝异常大的 API Request 或 Parameter。阈值必须基于正常 Traffic Baseline 设置，否则可能阻止合法 Upload 或复杂 Query。
English
IP sets hold IPv4 or IPv6 CIDRs for allowlists or blocklists and can be updated dynamically by automation; unlike security groups or NACLs, they participate in Layer 7 web ACL rules. Size-constraint statements compare components such as headers, bodies, or URIs with a threshold to reject abnormally large API requests or parameters. Thresholds should reflect legitimate traffic baselines so valid uploads or complex queries are not blocked.
Transcript
09:20 Further, you can also whitelist and blacklist
09:23 the IP addresses, and this could be IPv4 or IPv6 addresses.
09:27 Now, this is a very similar to
09:28 security group and network cases,
09:30 but, then, these IP addresses list could be dynamic.
09:33 You can automatically update that,
09:34 and then that will take care if there are new IPs detected.
09:39 Further, you can also define the size of the request,
09:43 and size with the maximum size you can define,
09:46 and then any request coming more than that
09:50 means, probably, there is something wrong,
09:52 because you know that
09:52 your APIs probably have a certain length, right?
09:56 The URI string, as well as the parameters.
09:59 So, you don't want to accept any API calls
10:02 bigger than that size,
10:04 and that's where the size limitations can be applied
10:07 to your request.
8. SQLi、Geo Match、String/Regex Match 构成更细的 Application Policy
时间范围：10:09–11:39
总结 / Summary
中文
SQL Injection Match 检查 Request Component 中可能改变 Database Query 语义的 Pattern，降低未参数化 Input 被利用的风险；Application 端仍应使用 Parameterized Query。Geo Match 根据 Request Origin Country Allow/Block，适用于 Regional Policy，但不能当作强 Identity Control。Byte/String Match 与 Regex Pattern Set 则定位业务特定 Token 或格式。把这些 Statement 用 AND/OR/NOT、Priority 与 Default Action 组合，才形成完整 Web ACL Policy。
English
SQL-injection match statements inspect request components for patterns that could alter database-query semantics, reducing exposure when inputs are not parameterized; applications must still use parameterized queries. Geo match allows or blocks by the request's country of origin and is useful for regional policy, though it is not strong identity verification. Byte or string matches and regex pattern sets identify application-specific tokens or formats. Combining these statements with AND, OR, NOT, priorities, and a default action creates a complete web ACL policy.
Transcript
10:09 Now, SQL injection, as I said, in your input fields, again,
10:12 you can send the SQL, and if it has not been validated well
10:16 in your code,
10:17 then that SQL code can get executed on the server,
10:21 and you can probably get all the database entries,
10:24 sensitive data, all that can happen.
10:27 Geographic match now allow or block the request
10:30 based on the country from which the request originates.
10:33 Now, if you know that
10:34 all your users are from a particular country,
10:36 then you don't want to allow any other users
10:39 from the other geographies.
10:41 Finally, you can write a rule in which you can, again,
10:46 match any part of HTTP request; header or body, right,
10:50 to match a particular string,
10:51 or even the regular expression match as well.
10:55 So, if you know some kind of words which should not be there
10:58 in the request, then you can, of course, write a rule,
11:02 and then those requests will be allowed or blocked
11:04 based on how you write your condition.
11:07 So, at high level,
11:08 these are all the conditions that you can write
11:12 under the Web ACLs,
11:13 and then your WAF rules will be in action.
11:17 Okay, with that, we talked about the WAF.
11:19 As you know, it protects your application at layer seven,
11:23 and typically it protects from all these attacks,
11:25 like cross-site scripting and SQL injections,
11:27 and then rest of others.
11:30 Okay, so, with that, we covered WAF at high level,
11:32 and you now understand what the WAF is.
11:34 Now, in the next lecture, we will see WAF in action.
整讲总结 / Overall Summary
中文
AWS WAF 是与 CloudFront、ALB、API Gateway、AppSync 等集成的 Layer 7 Managed Firewall。核心对象是 Web ACL、Rule、Statement、Priority、Action 与 WCU；可通过 Managed Rule Group、IP/Geo/Size/String/Regex、XSS/SQLi 和 Rate-based Rule 过滤 Web Attack。要同时理解 Body Inspection Limit、Oversize Handling、默认 403、传播延迟，以及 WAF 不能替代 Application Secure Coding、Network Firewall 或 DDoS Control。
English
AWS WAF is a managed Layer 7 firewall integrated with services such as CloudFront, ALB, API Gateway, and AppSync. Its core objects are web ACLs, rules, statements, priorities, actions, and WCUs. Managed rule groups plus IP, geo, size, string, regex, XSS, SQLi, and rate-based statements filter web attacks. Designs must also account for body-inspection limits, oversize handling, the default 403 response, propagation delay, and the fact that WAF does not replace secure coding, network firewalls, or DDoS controls.
返回顶部 ↑