<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-waf-rules
description: >-
  Design and implement Web Application Firewall rules across AWS WAF, Azure Front Door WAF,
  and GCP Cloud Armor to protect against OWASP Top 10, bot attacks, and API abuse.
domain: cybersecurity
subdomain: cloud-security
tags:
  - waf
  - aws-waf
  - azure-waf
  - cloud-armor
  - owasp
  - rate-limiting
  - bot-protection
  - api-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Cloud WAF Rules

## Overview

Cloud WAF services are a critical layer of defense for web applications and APIs.
This skill covers deploying managed rule sets, custom rules for application-specific
threats, rate limiting, geographic restrictions, and bot mitigation across AWS WAF,
Azure Front Door WAF, and GCP Cloud Armor.

Mode: `[MODE: ARCHITECT]` — Security architecture and implementation.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS WAF v2, Azure Front Door, or GCP Cloud Armor access | Required |
| IAM permissions for WAF rule management | Required |
| Understanding of protected application's traffic patterns | Required |
| Python 3.10+ with cloud provider SDKs | Required |

## Key Concepts

### AWS WAF Rule Groups

```bash
# Create IP set for known bad actors
aws wafv2 create-ip-set --name "blocked-ips" --scope REGIONAL \
  --ip-address-version IPV4 --addresses "203.0.113.0/24" "198.51.100.0/24"

# Create rate-based rule (100 requests per 5 min per IP)
aws wafv2 create-web-acl --name "app-waf" --scope REGIONAL \
  --default-action '{"Allow":{}}' \
  --rules '[{
    "Name": "rate-limit",
    "Priority": 1,
    "Action": {"Block":{}},
    "Statement": {
      "RateBasedStatement": {
        "Limit": 100,
        "AggregateKeyType": "IP"
      }
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "rate-limit"
    }
  }]' \
  --visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"app-waf"}'

# Add AWS Managed Rules (OWASP Core)
aws wafv2 list-available-managed-rule-groups --scope REGIONAL

# Key managed rule groups:
# AWSManagedRulesCommonRuleSet — OWASP core rules
# AWSManagedRulesSQLiRuleSet — SQL injection
# AWSManagedRulesKnownBadInputsRuleSet — Log4j, etc.
# AWSManagedRulesBotControlRuleSet — Bot mitigation
# AWSManagedRulesATPRuleSet — Account takeover prevention
```

### Azure Front Door WAF

```bash
# Create WAF policy with OWASP 3.2 ruleset
az network front-door waf-policy create --resource-group RG --name appWAF \
  --mode Prevention --sku Premium_AzureFrontDoor

# Add managed ruleset
az network front-door waf-policy managed-rules add --policy-name appWAF \
  --resource-group RG --type Microsoft_DefaultRuleSet --version 2.1

# Add custom rate limit rule
az network front-door waf-policy rule create --policy-name appWAF \
  --resource-group RG --name rateLimit --priority 100 --action Block \
  --rule-type RateLimitRule --rate-limit-duration-in-minutes 1 \
  --rate-limit-threshold 100
```

### GCP Cloud Armor

```bash
# Create security policy
gcloud compute security-policies create app-waf --description "Application WAF"

# Add OWASP rules
gcloud compute security-policies rules create 1000 \
  --security-policy app-waf --action deny-403 \
  --expression "evaluatePreconfiguredExpr('sqli-v33-stable')"

gcloud compute security-policies rules create 1001 \
  --security-policy app-waf --action deny-403 \
  --expression "evaluatePreconfiguredExpr('xss-v33-stable')"

# Rate limiting
gcloud compute security-policies rules create 2000 \
  --security-policy app-waf --action throttle \
  --expression "true" \
  --rate-limit-threshold-count 100 \
  --rate-limit-threshold-interval-sec 60 \
  --conform-action allow --exceed-action deny-429
```

### Custom Rules for API Protection

```bash
# AWS WAF — Block requests without API key header
aws wafv2 update-web-acl --name "api-waf" --scope REGIONAL \
  --id $ACL_ID --lock-token $LOCK \
  --rules '[{
    "Name": "require-api-key",
    "Priority": 5,
    "Action": {"Block":{}},
    "Statement": {
      "NotStatement": {
        "Statement": {
          "ByteMatchStatement": {
            "SearchString": "x-api-key",
            "FieldToMatch": {"Headers":{"MatchPattern":{"All":{}},"MatchScope":"KEY"}},
            "TextTransformations": [{"Priority":0,"Type":"LOWERCASE"}],
            "PositionalConstraint": "EXACTLY"
          }
        }
      }
    },
    "VisibilityConfig": {"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"require-api-key"}
  }]'
```

## Workflow

### Step 1: Assess Application Attack Surface

Identify endpoints, expected traffic patterns, and critical paths.

### Step 2: Deploy Managed Rulesets

```bash
node scripts/agent.js --provider aws --action deploy-managed --web-acl-name app-waf
```

### Step 3: Configure Custom Rules

```bash
node scripts/agent.js --provider aws --action add-rate-limit --limit 100 --web-acl-name app-waf
```

### Step 4: Enable Logging

```bash
# AWS WAF logging to S3
aws wafv2 put-logging-configuration --logging-configuration '{
  "ResourceArn": "WAF_ACL_ARN",
  "LogDestinationConfigs": ["S3_BUCKET_ARN"]
}'
```

### Step 5: Monitor and Tune

Review blocked requests, adjust rules to reduce false positives.

## Detection

```yaml
title: Cloud Waf Rules Detection
id: afe088c0-3721-4eb1-b0e2-f5efdb201102
status: experimental
description: Detects suspicious activity related to implementing cloud waf rules techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Waf Rules Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] OWASP Core Rule Set (CRS) deployed
- [ ] SQL injection rules active
- [ ] XSS protection rules active
- [ ] Rate limiting configured for all public endpoints
- [ ] Bot management rules deployed
- [ ] WAF logging enabled and forwarded to SIEM
- [ ] False positive rate < 0.1% of legitimate traffic
- [ ] Geographic restrictions applied where business requires

## References

- [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/)
- [Azure Front Door WAF](https://learn.microsoft.com/en-us/azure/web-application-firewall/)
- [GCP Cloud Armor](https://cloud.google.com/armor/docs)
- [OWASP ModSecurity Core Rule Set](https://coreruleset.org/)
