AWS WAF Integration

Block malicious IPs using AWS Web Application Firewall (WAF) IP sets.

Prerequisites

• AWS account
• AWS WAF v2 configured
• IAM credentials with WAF permissions
• An existing IP set in WAF

Required IAM Permissions

Create an IAM policy with these permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "wafv2:GetIPSet",
        "wafv2:UpdateIPSet",
        "wafv2:ListIPSets"
      ],
      "Resource": "*"
    }
  ]
}

Minimal Permissions (Recommended)

For production, restrict to specific resources:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "wafv2:GetIPSet",
        "wafv2:UpdateIPSet"
      ],
      "Resource": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/webdecoy-blocklist/*"
    },
    {
      "Effect": "Allow",
      "Action": "wafv2:ListIPSets",
      "Resource": "*"
    }
  ]
}

Creating an IP Set

Before configuring the integration, create an IP set in AWS WAF:

For Regional WAF (ALB, API Gateway)

1. Go to AWS WAF Console

2. Select your region

3. Go to IP sets

4. Click Create IP set

5. Configure:

   Field	Value
   Name	webdecoy-blocklist
   Region	Your application’s region
   IP version	IPv4

6. Click Create IP set

7. Copy the IP set ID

For CloudFront (Global)

1. Go to AWS WAF Console

2. Switch to Global (CloudFront)

3. Go to IP sets

4. Click Create IP set

5. Configure:

   Field	Value
   Name	webdecoy-blocklist-global
   Region	Global (CloudFront)
   IP version	IPv4

6. Click Create IP set

7. Copy the IP set ID

Setting Up Integration

1. Go to Integrations → AWS WAF

2. Click Add AWS WAF Integration

3. Enter credentials:

   Field	Description
   Access Key ID	AWS IAM access key
   Secret Access Key	AWS IAM secret key
   Region	AWS region (e.g., us-east-1)

4. Configure IP set:

   Field	Description
   IP Set ID	WAF IP set ID
   IP Set Name	Name for reference
   Scope	REGIONAL or CLOUDFRONT

5. Click Connect

Scope Options

Scope	Use Case
REGIONAL	ALB, API Gateway, AppSync
CLOUDFRONT	CloudFront distributions

Creating a WAF Rule

After setting up the IP set, create a rule to block IPs:

In AWS Console

1. Go to AWS WAF → Web ACLs

2. Select your Web ACL

3. Go to Rules

4. Click Add rules → Add my own rules

5. Configure:

   Field	Value
   Rule type	IP set
   Name	webdecoy-block-rule
   IP set	Select your IP set
   Action	Block

6. Click Add rule

Rule Priority

Place the WebDecoy block rule early in your rule list for fastest blocking.

Blocking Rules in WebDecoy

Configure when to add IPs to the block list:

1. Go to Integrations → AWS WAF → Rules

2. Click Add Rule

3. Configure:

   Setting	Description
   Rule Type	Block All or Block by Score
   Decoy	Which decoy triggers blocking
   Score Threshold	Minimum score (if by score)

4. Click Create Rule

Recommended Settings

Scenario	Score Threshold
High security	50+
Standard	70+
Conservative	85+

How It Works

Detection Created (score: 85)
        │
        ▼
AWS WAF Rule Evaluated
        │
        ├── Score >= Threshold? → Yes
        │
        ▼
Update IP Set via AWS API
        │
        ├── Add IP: 192.168.1.100/32
        │
        ▼
WAF Rule Blocks IP
        │
        ▼
Future requests from IP are blocked

IP Set Limits

Be aware of AWS WAF limits:

Limit	Value
IPs per IP set	10,000
IP sets per region	100
IP sets per Web ACL	10

WebDecoy automatically manages IP set size:

• Old entries are removed when approaching limits
• IPs are removed after configured duration

Managing Blocked IPs

View Blocked IPs

1. Go to Integrations → AWS WAF
2. Click View Blocked IPs
3. See:
   • IP address
   • Block reason
   • Added timestamp
   • Manual unblock option

Unblock an IP

From WebDecoy:

1. Find IP in blocked list
2. Click Unblock
3. IP is removed from AWS WAF IP set

From AWS Console:

1. Go to WAF → IP sets
2. Select your IP set
3. Remove the IP address

Multiple Regions

For applications in multiple regions, create separate integrations:

Integration	Region	IP Set
US East	us-east-1	webdecoy-blocklist-use1
EU West	eu-west-1	webdecoy-blocklist-euw1
Global	CloudFront	webdecoy-blocklist-global

Best Practices

Do’s

• ✅ Use minimal IAM permissions
• ✅ Create dedicated IP set for WebDecoy
• ✅ Monitor IP set size
• ✅ Set reasonable score thresholds
• ✅ Test blocking before production

Don’ts

• ❌ Use root AWS credentials
• ❌ Share IP set with other tools
• ❌ Set threshold too low
• ❌ Forget to create WAF rule for IP set

Troubleshooting

”Access Denied” Error

1. Verify IAM permissions include required actions
2. Check credentials are correct
3. Ensure region matches IP set region
4. For CloudFront, use CLOUDFRONT scope

”IP Set Not Found” Error

1. Verify IP set ID is correct
2. Check region matches
3. Ensure scope (REGIONAL/CLOUDFRONT) is correct
4. Verify IP set exists in AWS console

IPs Not Being Blocked

1. Verify integration is connected (green status)
2. Check blocking rule is enabled in WebDecoy
3. Verify WAF rule exists for the IP set
4. Check Web ACL is associated with your resource
5. Verify rule priority in Web ACL

IP Set Full

1. Increase IP set limit (contact AWS)
2. Reduce block duration
3. Increase score threshold
4. WebDecoy auto-removes oldest entries

Cost Considerations

AWS WAF pricing:

• Web ACL: $5/month
• Rule: $1/month
• Requests: $0.60 per million

The WebDecoy integration doesn’t add significant cost beyond existing WAF usage.

---

Next Steps

• Cloudflare - Alternative WAF integration
• Datadog - Monitoring integration
• Overview - All integrations