Hey everyone, I've been diving deeper into AWS security services as part of a new project at work. We're using WAF on some CloudFront distributions, and my lead asked me to figure out how we can *proactively* check if our WAF rules are configured according to our internal security policies. Like, are we blocking the right countries? Is the rate limiting always enabled on certain paths?
I found that AWS Config is actually the tool for this job, but the setup wasn't super obvious at first. I wanted to share my walkthrough for setting up a compliance check for a WAF rule. This uses a managed AWS Config rule called `WAFV2_LOGGING_ENABLED`, but the cool part is the custom policy.
The main idea is you create a custom AWS Config rule using Lambda. The Lambda function fetches your WAF Web ACL, inspects its rules, and returns whether it complies. Here's a super simplified Python snippet for a Lambda that checks if a specific rule (by name) exists and is configured to block traffic:
```python
import json
import boto3
def evaluate_compliance(configuration_item):
wafv2 = boto3.client('wafv2')
web_acl_arn = configuration_item['resourceId'] # From Config event
try:
response = wafv2.get_web_acl(
Name='MyWebACL',
Scope='CLOUDFRONT',
Id=web_acl_arn.split('/')[-2]
)
# Check if our critical rule "BlockBadCountries" exists and has ACTION = BLOCK
rules = response['WebACL']['Rules']
for rule in rules:
if rule['Name'] == 'BlockBadCountries':
if rule['Action']['Block'] == {}:
return 'COMPLIANT'
else:
return 'NON_COMPLIANT'
return 'NON_COMPLIANT' # Rule not found
except Exception as e:
return 'NON_COMPLIANT'
def lambda_handler(event, context):
invoking_event = json.loads(event['invokingEvent'])
configuration_item = invoking_event['configurationItem']
compliance_result = evaluate_compliance(configuration_item)
response = {
"ComplianceResourceType": configuration_item['resourceType'],
"ComplianceResourceId": configuration_item['resourceId'],
"ComplianceType": compliance_result,
"Annotation": f"Rule 'BlockBadCountries' check result.",
"OrderingTimestamp": invoking_event['notificationCreationTime']
}
return response
```
You then link this Lambda function to a new custom AWS Config rule. After it runs, you can see the compliance results in the AWS Config dashboard or even get SNS notifications.
The tricky part I ran into was the IAM permissions—the Lambda needs rights to describe WAF Web ACLs *and* for AWS Config to invoke it. Also, remember this runs periodically, so you're not catching drift in real-time, but it's great for a weekly audit.
Has anyone else set up something similar? I'm curious if there are other managed Config rules for WAF besides the logging one, or if most of you just build custom ones like this. Also, how do you handle testing the Lambda logic without waiting for the Config evaluation period?