So, let me show you quickly WAF, Shield
and Firewall Manager.
So, if you go into the console and you type WAF and Shield,
you arrive in this UI.
So we have WAF on the left hand side,
Shield in here and we have Firewall Manager in here.
So WAF helps you protect your web applications
from common web exploits at the layer seven
So it's for your Amazon API gateway,
your CloudFront distributions
or an Application Load Balancer.
So then what you would do
is that you would create a web ACL out of it.
So we'll give it a name, 'Demo Web ACL',
and then whether or not it's for a regional resource,
such as your ALB, API gateway or others,
or if it's a CloudFront distribution,
in which case it is going to be global for CloudFront
and only in U.S. East one.
So, let's go back to regional resource
and then I'm going to say, this is going to go into
say for example the Ireland region of Europe,
and this is again my 'Demo Web ACL.
Okay.
So, we can associate resources with it,
so which resources do we want to protect with this?
So I don't have any ALB right now
but this is where you would add AWS resources to it
by just clicking on this button
and finding the right resource to protect with your web ACL.
Next, you need to add some rules.
So, you can add many rules into your web ACL.
So, we can add managed rule groups or create your own rules.
So, what about managed rules?
Well, you can have a look at the categories.
You have some coming from AWS
but also some coming from partners.
And if you look at AWS,
we can have, for example, a bot control rule
to prevent bots from accessing our application.
Or we can have a look at the Amazon IP reputation list
to only have access to IP that are reputable
into our application.
Or we can block for example, anonymous IPs,
so let's add this one.
Here, we're going to block IPs coming from VPNs,
from proxies and so on.
And let's have known bad inputs
so we know that like some inputs are bad
so let's block them as well.
So, we add all these rules, okay?
And as you can see, each rule has a capacity.
So, the maximum capacity is 1500,
this is so that you don't have too many rules
on the web ACL.
So, now I'm protected against anonymous IPs and bad inputs.
Okay.
So what happens if it doesn't match any rule
then the default action is to allow,
else it will be blocked.
So, let's click on next.
Here, we can set up the rule priorities.
So, do you want to have first the bad inputs rule set
or the anonymous IP list, so you can change this.
Then you would have metrics associated with it.
And finally, you could go ahead and create this web ACL.
So, this is a created, and if you wanted to
you could associate it with your ALB,
your API gateway and so on.
So, this is for WAF and next.
And also in here, you could set up IP sets
and this is where you would set up your IP addresses, okay?
One per line inside your format,
run what to block or what to allow in.
Okay, so next we have Shield.
So, Shield is to get DDoS protection
and if I click on subscribe to Shield Advanced,
I'm going to pay $3,000 per month, which I will not do.
So, the idea is that you just know
that Shield is for DDoS protection
and we just don't experiment with it
otherwise we're gonna have a bad surprise.
So, I'm going to scroll down and go to Firewall Manager.
So, Firewall Manager is to have
centralized security management of your rules.
So, you can create a policy,
but again a policy will cost you $100 per month.
So. I will not display this
but the idea is that all these policies
will be applied to all accounts across your organization.
So if you wanted to just go through policy,
you can have it look quickly, the options.
So you can apply a policy for WAF, for Shield Advanced,
for security groups, network firewalls, or more.
And so this is WAF,
let's apply to, for example the Ireland region.
And if I were to do so
then I would be able to define a WAF policy
for all my accounts for the Ireland region.
So you could configure the rules here
and then you could have more configuration and so on.
So hopefully you get the idea of these three services
and you understand how they compliment each other.
I hope you liked it
and I will see you in the next lecture.