Phase 2: Enhanced Protection | Implement Custom WAF Rules for Pattern Matching

evereven_AWS_WAF_CREATE_pattern-matching-rules.sh

# A vantablack friday: How to be prepared to stop DDoS Attacks after Halloween
# https://blog.evereven.tech

# Create a WebACL Group Rule (replace [SUSPICIOUS_AGENT_IN_BASE64]) 
aws wafv2 create-rule-group \
  --name "pattern-matching-rules" \
  --scope REGIONAL \
  --capacity 1000 \
  --visibility-config \
    MetricName=DDOSRuleMetric,SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true \
  --rules '[
        {
            "Name": "BadUserAgentRule",
            "Priority": 2,
            "VisibilityConfig": {
                "SampledRequestsEnabled": true,
                "CloudWatchMetricsEnabled": true,
                "MetricName": "RateBasedRuleMetric"
            },
            "Statement": {
                "ByteMatchStatement": {
                    "SearchString": "[SUSPICIOUS_AGENT_IN_BASE64]",
                    "FieldToMatch": {
                        "SingleHeader": {
                            "Name": "user-agent"
                        }
                    },
                    "TextTransformations": [
                        {
                            "Priority": 1,
                            "Type": "NONE"
                        }
                    ],
                    "PositionalConstraint": "CONTAINS"
                }
            },
            "Action": {
                "Block": {}
            }
        }
    ]'
    
# Check at:      
# https://us-east-1.console.aws.amazon.com/wafv2/homev2/rule-groups