AWS Tutorial — Secure your website with ACM, Amazon Cloudfront and AWS WAF
In previous tutorials, we explored how to store our website’s file in a bucket and then connect this bucket to a custom domain. In this tutorial, we will go one step further and talk about how we can protect our website and secure it against possible threats.
Watching our deployed website is, without any doubt, exciting, like unboxing a new toy. However, it’s not the end of the road, because we need to take into consideration the fact that there are many threats on the web. Issues such as latency and web exploits can affect our website’s availability and security.
For this reason, in today’s tutorial, we will take a look on a few AWS services that can help ensure our website’s protection. More specifically, we will:
- secure our website with SSL/TLS using ACM (Amazon Certificate Management).
- provide global distribution with Amazon Cloudfront
- provide protection against suspicious requests with AWS WAF (Web Application Firewall). More specifically, we will apply a rule, so thag we can block requests routed to our website if the URL contains the keyword “block-me”.
Prerequisites
In this tutorial, we will not develop anything locally. Before jumping into AWS console, I’d like to mention that there are some prerequisites that need to be covered:
- an active AWS account.
- an already registered domain name in Amazon Route 53. There’s no reason to worry if you don’t have one. You can still follow this tutorial for learning purposes.
Step 1. Request an SSL/TLS certificate with ACM
An SSL/TLS certificate is essential because it provides authentication, encryption and data integrity. We can create one for our website through Amazon Certificate Management (ACM). As its name suggests ACM is a service that can easily create, store and renew public and private SSL/TLS certificates.
We start by requesting a new certificate. One thing that we need to take into consideration is that the region in which we store our certificate must be us-east-1 (N.Virginia).
In order to complete the request, we just need to provide a fully qualified domain name, that refers to the registered domain that we already have. We leave the rest of the default configuration as it is.
It takes a couple of minutes, and our SSL/TLS certificate is ready.
Step 2. Create a Cloudfront Distribution
Once we have received the certificate, it’s time to take care of the way our website is delivered. AWS provides a service named Amazon Cloudfront, which guarantees faster website distribution and content delivery(images, videos etc.).
For the purposes of this tutorial we will choose a paid plan, and more specifically the “Pro” plan, so we can apply the protection rule that we discussed earlier. Of course, you can choose the free plan if you want to avoid additional costs. It is, however, recommended to take a look at the other options, so you have an idea of what they offer.
Next, we provide a name for our distribution, and then we fill in the managed domain from Route 53. As we see in the message that we get, “CloudFront can automatically manage your DNS for you”.
If the files of our website are originally stored in an S3 bucket, we choose this as origin type, and by browsing the S3, we find the endpoint to our bucket.
On the “Enable Security” tab we’re given the option to integrate our distribution with Web Application Firewall (WAF) to establish some basic protection rules. We click on “Next”, and on the “Get TLS Certificate” tab, we see that we have automatically received the certificate that we created in ACM. We select it and click on “Next”.
Finally we click on “Create distribution”. We may have to wait a few seconds until it is enabled.
Before moving on to the WAF configuration, there is one last thing to take care of in our Cloudfront distribution.
Inside the“General” tab, we see that, the value of “Default root object” is empty. We need to update the value of this field.
And what value exactly do we have to fill in?
But of course, since our resources are stored in an S3 bucket we need to look for the index document inside the “Static website hosting” properties of our S3 bucket. In this case, the name of the index document is index.html .
Step 3. Configure AWS WAF
Get Ioannis Koinaris’s stories in your inbox
Join Medium for free to get updates from this writer.
Apart from SSL/TLS certificate and distribution, we also need to provide a firewall to handle the requests that are routed to our website. AWS Web Application Firewall (WAF) is our partner in crime because, as an application firewall, it inspects and blocks suspicious requests forwarded to our resources.
As we mentioned before, a new protection package was created when we configured our Cloudfront distribution. The package’s name starts with “CreatedByCloudFront” and is already listed.
If we click on the protection package, we can a list the the protection rules that were initially created within it. We will click on “Add rule” and start creating the blocking rule.
We select the “Custom rule” , and then we see the four different types of custom rules:
- IP-based rule
- Geo-based rule
- Rate-based rule
- Custom rule
We create a custom rule with the following configuration:
- Action: Block
- Rule name: blocking-rule (or any other valid name)
- If a request: matches the statement
- Inspect: Query string
- Statement Match type: Contains string
- String to match: block-me
The JSON format of this rule is the following:
{
"Name": "blocking-rule",
"Action": {
"Block": {}
},
"Priority": 0,
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "blocking-rule"
},
"Statement": {
"ByteMatchStatement": {
"FieldToMatch": {
"QueryString": {}
},
"PositionalConstraint": "CONTAINS",
"SearchString": "block-me",
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
}
}Now, if we go back to our Cloudfront distribution and open the “Security” tab, we see that in the “Security-Web Application Firewall” section, the blocking rule was successfully added to the list of rules.
Step 4. Test the Cloudfront distribution
We have finally completed the configuration of security for our website and it’s time to perform some tests.
First we’ll test whether Cloudfront is successfully configured. We’ll go inside our distribution and find the field “Distribution domain name”.
We’ll copy the value and paste it in a new browser tab.
Yep! Our website opens successfully. One test down, two to go!!
Step 5. SSL/TLS Certificate
Now we will verify that an SSL certificate was provided to our website. We’ll click on the lock symbol next to the URL and open the certificate. We can see that our certificate was issued by a trusted CA, aka Amazon.
Step 6. Test the WAF package blocking rule
Finally we’ll check if our website has WAF protection, by testing the blocking-rule that we created earlier.
Let’s add a query string to the URL i.e. block-me=true and see what happens:
As expected, we get a 403 error! Yeah!!
Step 7. Clean up resources
After our testing is completed, we can move on and clean up our resources.
First we need to disable the Cloudfront distribution. If we have chosen a paid plan we have to cancel the plan and then move on to disable the distribution. After a while we’ll be able to delete it. The WAF protection package that was created will be automatically deleted. Finally we delete the SSL/TLS certificate.
I hope you enjoyed this tutorial! Now you are capable of providing security to your website and protect it from possible threats. Kudos!!
