v1.487.0

Add Scoped Rate Limits and Bot Control Machine Learning to WAF Component @RoseSecurity (#1103)

what

• Added enable_machine_learning parameter inside aws_managed_rules_bot_control_rule_set configuration
• Adds scope_down_statements with byte matching support

why

• AWS highly recommends safeguarding against HTTP request floods; they advise implementing two rate limiting rules for web traffic. The initial rule employs AWS WAF's rate-based rules to automatically block IP addresses of malicious actors if the number of requests in a 5-minute sliding window surpasses a predefined threshold. The second rule focuses on a more detailed approach, allowing for targeted blocking. This is achieved by using scope_down_statements to refine the criteria for blocking, enhancing the precision of the defense mechanism.
• Added enable_machine_learning argument to avoid idempotency problem if you use "COMMON" inspection level

example

testing

Utilized the following example Atmos component:

        rate_based_statement_rules:
          - name: "scoped-rate-limit"
            action: "block"
            priority: 10
            statement:
              limit: 1000
              aggregate_key_type: "IP"
              evaluation_window_sec: 300
              scope_down_statement:
                byte_match_statement:
                  field_to_match:
                    uri_path: true
                  positional_constraint: "STARTS_WITH"
                  search_string: "/test"
                  text_transformation:
                    - priority: 0
                      type: "NONE"

references

• AWS WAF – Rate-based rules
• Rate-based rule request rate limiting behavior