AWS Amplify Sites Gain Firewall Support for Enhanced Security

In a significant update for web application developers, Amazon Web Services (AWS) has announced the general availability of the AWS Web Application Firewall (WAF) integration with AWS Amplify Hosting. This development is a major step forward in simplifying the process of securing web applications hosted on AWS Amplify. Previously, developers had to rely on more complex architectures involving Amazon CloudFront distributions combined with AWS WAF to ensure their applications were protected against various online threats. This not only required additional expertise but also increased the management overhead.

With the launch of AWS WAF in Amplify Hosting, developers can now benefit from a streamlined process where they can directly connect a web application firewall to their AWS Amplify applications. This integration is available with just a single click in the Amplify console or by using infrastructure as code (IaC). The integration provides access to the full suite of AWS WAF capabilities, including managed rules that defend against common vulnerabilities such as SQL injection and cross-site scripting (XSS). Additionally, developers have the option to create custom rules tailored to the specific needs of their applications.

This new feature enhances the ability to implement defense-in-depth security strategies for web applications. AWS WAF offers rate-based rules that help mitigate distributed denial of service (DDoS) attacks by controlling the volume of requests from specific IP addresses. Another useful feature is geo-blocking, which allows developers to restrict access to applications based on geographic locations. This is particularly beneficial for services intended for specific regions.

How It Works

Setting up AWS WAF protection for an Amplify app is a straightforward process. By accessing the Amplify console, developers can navigate to their app settings, select the Firewall tab, and choose the predefined rules they wish to apply. This user-friendly interface simplifies the configuration of firewall rules, enabling the activation of four main protection categories:

1. Amplify-Recommended Firewall Protection – This option safeguards against the most prevalent vulnerabilities in web applications, blocks IP addresses deemed a threat based on Amazon’s internal threat intelligence, and protects against malicious users identifying application vulnerabilities.
2. Restrict Access to amplifyapp.com – By restricting access to the default Amplify-generated amplifyapp.com domain, developers can prevent bots and search engines from crawling the domain, which is particularly useful when a custom domain is added.
3. Enable IP Address Protection – This feature allows or blocks web traffic by specifying IP address ranges, giving developers control over who can access their applications.
4. Enable Country Protection – Access can be restricted based on specific countries, providing an additional layer of security tailored to geographic considerations.

   The protections configured through the Amplify console result in the creation of an underlying web access control list (ACL) in the AWS account. For more detailed rulesets, developers can utilize the AWS WAF console rule builder to customize their security settings further.

   Once the configuration is complete, typically within a few minutes, the rules are applied to the app, and AWS WAF begins blocking any suspicious requests. Developers can also simulate attacks to see AWS WAF in action and monitor these using the AWS WAF request inspection capabilities. For instance, sending a request with an empty User-Agent value can trigger a blocking rule in AWS WAF.

   An example of a valid request might look something like this:

   shell<br /> curl -v -H "User-Agent: MyUserAgent" https://main.d3sk5bt8rx6f9y.amplifyapp.com/<br />

   This would result in an HTTP 200 (OK) message, indicating successful access. Conversely, a request with no value for the User-Agent HTTP header would result in an HTTP 403 (Forbidden) message, showcasing the effectiveness of AWS WAF in blocking unauthorized access:

   shell<br /> curl -v -H "User-Agent: " https://main.d3sk5bt8rx6f9y.amplifyapp.com/<br />

   Monitoring and Fine-Tuning
   

   AWS WAF offers detailed visibility into request patterns, which assists developers in fine-tuning their security configurations over time. Logs can be accessed via Amplify Hosting or the AWS WAF console, providing valuable insights into traffic trends and allowing for refined security rules as necessary.

   Availability and Pricing
   

   The AWS WAF integration is available across all AWS Regions where Amplify Hosting operates. This integration behaves as an AWS WAF global resource, similar to Amazon CloudFront, meaning that web ACLs can be attached to multiple Amplify Hosting apps as long as they are within the same region.

   Pricing for this integration follows the standard AWS WAF pricing model, where costs are incurred based on the number of web ACLs, rules, and requests used. Additionally, AWS Amplify Hosting charges an extra $15 per month when a web application firewall is attached to an application, with costs being prorated by the hour.

   This new functionality brings enterprise-grade security features to all Amplify Hosting customers, ranging from individual developers to large enterprises. It allows users to build, host, and secure their web applications within a single service, thereby reducing architectural complexity and streamlining security management efforts.

   For more detailed information, developers are encouraged to visit the AWS WAF integration documentation for Amplify or to try the integration directly in the Amplify console.

   Conclusion
   

   AWS’s announcement of the general availability of AWS WAF integration with AWS Amplify Hosting marks a milestone in making robust security measures more accessible to developers. By simplifying the process of configuring and managing web application firewalls, AWS is empowering developers to focus on building innovative applications without compromising on security. As the digital landscape continues to evolve, such integrations play a crucial role in ensuring that web applications remain resilient against the ever-increasing array of cyber threats.

   To learn more about this integration, visit AWS WAF Integration Documentation for Amplify.

For more Information, Refer to this article.