Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
When deploying API Gateway endpoints that require protection against common web attacks
When implementing rate limiting and throttling to prevent API abuse and DDoS attacks
When building bot detection and mitigation for API endpoints exposed to the internet
When compliance requires WAF protection for all public-facing API endpoints
When customizing access controls based on IP reputation, geolocation, or request patterns
Do not use for network-level DDoS protection (use AWS Shield), for application logic vulnerabilities (use SAST/DAST tools), or for internal API security between microservices (use service mesh authentication and authorization).
Common Misconfigurations & Verification
Web ACL created but never associated protects nothing. Confirm attachment with aws wafv2 get-web-acl-for-resource --resource-arn arn:aws:apigateway:REGION::/restapis/API_ID/stages/prod. API Gateway requires --scope REGIONAL; a CLOUDFRONT-scope ACL will not attach.
Rules left in Count / OverrideAction: Count log but never block. Verify the intended managed groups and custom rules show Action: Block in get-web-acl, not Count.
Rate-based window misunderstanding:RateBasedStatementLimit is requests per trailing 5-minute window aggregated per source IP (5-min minimum), so 2000 is not per-minute. Clients behind shared NAT share a key. Confirm blocking with get-rate-based-statement-managed-keys.
Scope-down match misses: a ByteMatchStatement on /api/auth/login with LOWERCASE won't match URL-encoded or case-sensitive upstream paths. Body inspection only covers the first 8 KB unless SizeConstraintStatement uses OversizeHandling: MATCH.
"Require x-api-key" is not auth: the NotStatement + PositionalConstraint: EXACTLY empty-string pattern blocks missing/empty headers but allows any wrong key.
Verify it actually works: send a known SQLi/XSS payload and confirm a 403 appears in aws wafv2 get-sampled-requests --rule-metric-name ...; flood the login path and confirm RateLimitLogin blocks; and confirm logging is on via (otherwise blocks aren't auditable). Start new rules in Count, review samples, then flip to Block.
get-logging-configuration
Prerequisites
AWS API Gateway (REST or HTTP API) deployed with public endpoints
IAM permissions for wafv2:* and apigateway:* operations
CloudWatch and S3 or Kinesis Firehose configured for WAF logging
Understanding of the API's expected traffic patterns for rate limiting configuration
IP reputation lists or threat intelligence feeds for custom IP blocking
Workflow
Step 1: Create a WAF Web ACL with Managed Rule Groups
Create a Web ACL with AWS Managed Rules for baseline protection against OWASP Top 10 attacks.
AWS WAF access control list that defines the collection of rules and their actions (allow, block, count) applied to associated resources
Managed Rule Group
Pre-configured set of WAF rules maintained by AWS or third-party vendors for common attack patterns like OWASP Top 10
Rate-Based Rule
WAF rule that tracks request rates per IP address and blocks traffic exceeding a defined threshold within a 5-minute window
Bot Control
AWS WAF managed rule group that identifies and manages automated traffic including scrapers, crawlers, and attack bots
IP Reputation List
AWS-maintained list of IP addresses associated with malicious activity including botnets, scanners, and known attackers
Custom Response
WAF capability to return specific HTTP status codes and custom response bodies when blocking requests
Tools & Systems
AWS WAF: Web application firewall service for protecting API Gateway, ALB, CloudFront, and AppSync endpoints
AWS Managed Rules: Pre-built rule groups for common attack patterns maintained by AWS security team
AWS Firewall Manager: Central management of WAF policies across multiple accounts in AWS Organizations
Kinesis Firehose: Streaming delivery service for WAF logs to S3, Elasticsearch, or third-party analytics
CloudWatch: Monitoring service for WAF metrics including allowed, blocked, and counted requests
Common Scenarios
Scenario: Protecting a Public API from Credential Stuffing and Bot Attacks
Context: A public REST API experiences thousands of authentication attempts per hour from automated bots attempting credential stuffing against the /api/auth/login endpoint.
Approach:
Create a Web ACL with AWS Managed Rules Common Rule Set for baseline protection
Add a rate-based rule limiting the login endpoint to 100 requests per IP per 5 minutes
Enable Bot Control managed rules to detect and block automated traffic
Add IP Reputation List to block known malicious IPs proactively
Create a custom rule blocking requests without proper User-Agent headers
Enable WAF logging and create CloudWatch alarms for high block rates
Review sampled blocked requests weekly to tune rules and reduce false positives
Pitfalls: Rate limiting by IP can block legitimate users behind shared NAT gateways or corporate proxies. Consider using API key or authenticated session-based rate limiting for more granular control. Bot Control rules in COMMON inspection level may block legitimate API clients; start in Count mode and review before switching to Block.
