Amazon announced on Tuesday the availability of AWS WAF, a web application firewall that helps Amazon Web Services customers protect their apps from common exploits.
AWS WAF, launched on the first day of Amazon’s AWS re:Invent 2015 conference, is designed to give users control over the type of traffic that is allowed or not allowed to reach their web applications. By defining Access Control Lists (ACLs), rules, and actions, users can block SQL injection, cross-site scripting (XSS) and other common attack patterns. Rules can also be created for each user’s specific application.
The new security product also includes a full-featured API that can be used to automate the creation, deployment and maintenance of rules.
Jeff Barr, chief evangelist for Amazon Web Services, published a blog post detailing the various AWS WAF concepts, including conditions, rules, web ACLs, and actions.
Barr explained that conditions are designed for inspecting incoming requests. They can analyze the incoming IP address and various parameters of the request, such as URI, query string, HTTP header, and HTTP method.
Rules rely on these conditions to block or allow certain types of requests, while actions dictate the action that is taken when a request matches the conditions in a rule. ACLs reference one or more of these rules and the action that is taken for each of them.
Before the rules and filters are deployed, users need to identify the Amazon CloudFront distribution they want to protect with AWS WAF.
By Eduard Kovacs on October 07, 2015
Full article:
Source: Amazon Launches Web Application Firewall for AWS | SecurityWeek.Com
Linux Security Blog 