Hi everyone. I'm still pretty new to managing AWS security at scale. I got tired of manually adjusting WAF rules every time we saw a new attack pattern in the logs, so I tried automating it.
I made a Python script that analyzes CloudFront/WAF logs for unusual request patterns and suggests ACL updates. It's basic, but it helped us block a new scanner last week. 😅 Could you take a look and tell me if this is a sane approach? Mainly worried about false positives.
```python
# This parses logs for top offending IPs and paths, then prints suggested WAFv2 CLI commands.
import json
from collections import Counter
# ... (log parsing logic here) ...
def generate_ip_set_update(ips):
# Returns CLI command to update an IPSet
ip_list = ' '.join([f'IP={ip}' for ip in ips])
return f"aws wafv2 update-ip-set --scope REGIONAL --name BlockedIPs --addresses {ip_list} --lock-token "
# Example output from a run:
# Suggested: Add 192.0.2.1, 198.51.100.100 to blocked IPSet.
```