Phase 1: Immediate Response | Deploy Emergency WAF Rules (Rate based rules)

evereven_AWS_WAF_CREATE_emergency-ddos-rules.sh

# A vantablack friday: How to be prepared to stop DDoS Attacks after Halloween
# https://blog.evereven.tech

# Create a WebACL Group Rule
aws wafv2 create-rule-group \
    --name "emergency-ddos-rules" \
    --scope REGIONAL \
    --capacity 1000 \
    --visibility-config \
        MetricName=DDOSRuleMetric,SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true \
    --rules '[
        {
            "Name": "RateBasedRule",
            "Priority": 1,
            "VisibilityConfig": {
                "SampledRequestsEnabled": true,
                "CloudWatchMetricsEnabled": true,
                "MetricName": "RateBasedRuleMetric"
            },
            "Statement": {
                "RateBasedStatement": {
                    "Limit": 2000,
                    "AggregateKeyType": "IP"
                }
            },
            "Action": {
                "Block": {}
            }
        }
    ]'
    
# Check at:      
# https://us-east-1.console.aws.amazon.com/wafv2/homev2/rule-groups