Rule: ELB Application Load Balancers with WAF Enabled
This rule states that ELB application load balancers should have Web Application Firewall (WAF) enabled.
| Rule | ELB application load balancers should have Web Application Firewall (WAF) enabled |
| Framework | Federal Financial Institutions Examination Council (FFIEC) |
| Severity | ✔ Medium |
Rule Description: Enable Web Application Firewall (WAF) for ELB application load balancers in compliance with the Federal Financial Institutions Examination Council (FFIEC).
To ensure compliance with FFIEC regulations, enable the Web Application Firewall (WAF) for your ELB (Elastic Load Balancer) application load balancers. The WAF provides an extra layer of security by inspecting and filtering traffic to your application at the application layer.
Troubleshooting Steps:
If you encounter any issues while enabling the WAF for your ELB application load balancers, follow these troubleshooting steps:
- 1.
Verify IAM Permissions: Ensure that the IAM user or role used to enable the WAF has the necessary permissions. The user or role should have the "AWSWAFReadOnlyAccess" or "AWSWAFFullAccess" policy attached.
- 2.
Check WAF Capacity: Confirm that you have sufficient WAF capacity units available in your AWS account. You can check this by navigating to the AWS WAF console and inspecting the "WAF Capacity Units" section. If there are no available units, you may need to request an increase in WAF capacity.
- 3.
Verify ELB Configuration: Double-check the configuration of your ELB application load balancers. Ensure that they are correctly associated with the appropriate AWS resources, such as EC2 instances or AWS Lambda functions.
- 4.
Review WAF Rules: Examine the WAF rules applied to your ELB. Make sure that the rules align with FFIEC requirements and adequately protect against common web application vulnerabilities, such as SQL injection or cross-site scripting attacks.
- 5.
Monitor WAF Logs: Monitor the WAF logs to identify any potential issues or suspicious activities. The logs can provide valuable insights into the traffic passing through the WAF and help detect and mitigate potential security threats.
Necessary Codes:
There are no specific codes to enable WAF for ELB application load balancers. The process is performed through the AWS Management Console or AWS Command Line Interface (CLI).
Step-by-Step Guide for Remediation:
Follow these steps to enable Web Application Firewall (WAF) for your ELB application load balancers:
- 1.
Log in to the AWS Management Console at https://console.aws.amazon.com.
- 2.
Navigate to the AWS WAF service by clicking on "Services" in the top menu bar and selecting "WAF & Shield."
- 3.
In the WAF & Shield console, select "Web ACLs" from the sidebar menu.
- 4.
Click on the "Create web ACL" button.
- 5.
Provide a name for your web ACL and an optional description to help identify it later.
- 6.
Select the region where your ELB application load balancers are deployed.
- 7.
Choose the rule group that aligns with the FFIEC requirements or create custom rules tailored to your specific needs.
- 8.
Define the rules within the rule group to protect against common web application vulnerabilities.
- 9.
Choose the action to take when a rule within the rule group is triggered. You can either allow the traffic or block requests that match the rule conditions.
- 10.
Click on the "Next" button to review and create the web ACL.
- 11.
Review the summary of your web ACL configuration and click on the "Create web ACL" button to enable the WAF.
- 12.
Once the web ACL is created, navigate to your ELB application load balancer settings.
- 13.
Click on the "Listeners" tab and select the appropriate listener.
- 14.
In the "Edit Listener" screen, scroll down to find the "Default actions" section.
- 15.
Click on the "Add action" button and select "Forward to web ACL" from the dropdown menu.
- 16.
Choose the web ACL you created in step 5 from the list.
- 17.
Click on the "Save" or "Update" button to apply the changes.
- 18.
Wait a few minutes for the changes to propagate and the WAF to become fully operational.
Congratulations! You have successfully enabled Web Application Firewall (WAF) for your ELB application load balancers in compliance with FFIEC regulations. The WAF will now provide an additional layer of protection to your web applications by inspecting and filtering incoming traffic.