Hey folks, hope everyone's having a productive week. I've been neck-deep in AWS WAF for the last month, trying to get our security audit documentation in order. You know the drill: the compliance team needs a human-readable list of every rule, condition, and action across all our Web ACLs and rule groups, and clicking through the AWS console for a dozen ACLs just doesn't cut it.
I found the native JSON export from the CLI or API to be... well, a bit of a nightmare for non-engineers to parse. It's great for machines, but trying to map a `RuleGroupId` back to its statement logic for a spreadsheet? Not fun.
So, I did what any of us would do and spent a Saturday afternoon writing a Python script to pretty-print it all into a Markdown document. It's nothing revolutionary, but it's been a lifesaver for our audit prep and might save some of you the same headache.
The script uses Boto3 to fetch all Web ACLs in a region, then drills down to list the rules and their statements. My main goal was clarity for reviewers, so I focused on:
* **Structure:** A clear hierarchy showing Web ACL -> Rules -> Conditional statements.
* **Readability:** Converting things like `FieldToMatch` (e.g., `"UriPath"`) and `ComparisonOperator` (e.g., `"ContainsWord"`) into plain English descriptions.
* **Action Visibility:** Clearly calling out whether a rule is set to `ALLOW`, `BLOCK`, `COUNT`, or `CAPTCHA`.
* **Priority Order:** Maintaining the rule processing order.
Here's a snippet of the kind of output it generates for a single rule:
**Web ACL:** my-app-acl-prod (arn:aws:wafv2:us-east-1:...)
* **Rule:** AWS-AWSManagedRulesCommonRuleSet (Priority: 0)
* **Action:** BLOCK
* **Managed Rule Set:** AWSManagedRulesCommonRuleSet
* **Override Action:** none
* **Rule:** Custom-SQLi-Block (Priority: 1)
* **Action:** BLOCK
* **Statement (AND):**
- **Condition:** URI path `ContainsWord` any of [`/api`, `/admin`]
- **Condition:** Query string `ContainsString` any of [`'`, `--`, `union`]
It even handles rate-based rules and geo-match statements, formatting them sensibly. I run it periodically and dump the output into our internal audit wiki. The compliance folks loved it because they can actually search and reference specific logic now.
Has anyone else built similar tooling for WAF governance? I'm curious if you approached it differently—maybe directly into a CSV for spreadsheets folks, or integrated with a dashboard like Tableau for visualization? I'm thinking of extending this to also map which resources (CloudFront, ALB, API Gateway) are attached to each ACL for a full ecosystem view.
Let me know if you're interested in the code—I'm happy to clean it up and share. It's mostly a big loop with a bunch of `if` statements to interpret the JSON.
—Jake
Spreadsheets > opinions