Skip to content

Import existing TW WAF rules #909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
farski wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Import existing TW WAF rules #909

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f553c13
Import existing TW WAF rules
farski Jun 26, 2026
4ca53d4
Remove Spain
farski Jul 10, 2026
13686ae
Remove Brazil captcha
farski Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 87 additions & 0 deletions theworld/terra/templates/apps/frontend.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,6 +883,93 @@ Resources:
Allow: {}
Description: !Sub Frontend WAF for The World ${EnvironmentType} CDN
Name: !Sub ${EnvironmentTypeAbbreviation}-tw-frontend
Rules:
- Name: AWSManagedRulesCommonRuleSet
Priority: 10
OverrideAction:
None: {} # Use None to respect the rule group's actions
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesCommonRuleSet
# Version: (exclude to use vendor default version)
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: AWSManagedRulesCommonRuleSet
- Name: AWSManagedRulesKnownBadInputsRuleSet
Priority: 20
OverrideAction:
None: {} # Use None to respect the rule group's actions
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesKnownBadInputsRuleSet
# Version: (exclude to use vendor default version)
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: AWSManagedRulesKnownBadInputsRuleSet
- Name: AWSManagedRulesAmazonIpReputationList
Priority: 30
OverrideAction:
None: {} # Use None to respect the rule group's actions
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesAmazonIpReputationList
# Version: (exclude to use vendor default version)
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: AWSManagedRulesAmazonIpReputationList
- Name: BadBots
Priority: 100
Statement:
RegexPatternSetReferenceStatement:
# TODO Sort out multi-region
Arn: arn:aws:wafv2:us-east-1:976680550710:global/regexpatternset/BadBots/77983be8-c291-4263-97fc-08424eaee286

@kookster kookster Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not automatic, so probably fine - can look up the regex list value in west if we wanted to

FieldToMatch:
SingleHeader:
Name: user-agent
TextTransformations:
- Priority: 0
Type: LOWERCASE
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: BadBots
Action:
Block: {}
- Name: InternationalBots
Priority: 110
Statement:
GeoMatchStatement:
CountryCodes:
- VN
- SG
- BR
- HK
- MY

@kookster kookster Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These change at times, but we have had rules for them for awhile, so I agree, best to default back to them

VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: InternationalBots
Action:
Captcha: {}
- Name: AWSManagedRulesBotControlRuleSet
Priority: 200
OverrideAction:
Count: {} # Override all rules in rule set to count-only
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesBotControlRuleSet
Version: Version_6.0

@kookster kookster Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OT: I didn't find much info about what versions are better or worse for this?

VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: AWSManagedRulesBotControlRuleSet
Scope: CLOUDFRONT
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
Expand Down
57 changes: 57 additions & 0 deletions theworld/terra/templates/apps/wordpress.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1107,6 +1107,63 @@ Resources:
Allow: {}
Description: !Sub WordPress WAF for The World ${EnvironmentType} CDN
Name: !Sub ${EnvironmentTypeAbbreviation}-tw-wordpress
Rules:
- Name: InternationalBots
Priority: 10
Statement:
GeoMatchStatement:
CountryCodes:
- VN
- HK
- SG
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: InternationalBots
Action:
Captcha: {}
- Name: BadBots
Priority: 20
Statement:
RegexPatternSetReferenceStatement:
# TODO Sort out multi-region
Arn: arn:aws:wafv2:us-east-1:976680550710:global/regexpatternset/BadBots/77983be8-c291-4263-97fc-08424eaee286
FieldToMatch:
SingleHeader:
Name: user-agent
TextTransformations:
- Priority: 0
Type: LOWERCASE
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: BadBots
Action:
Block: {}
- Name: AdminKnownGeosOnly

@kookster kookster Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

really nice to have this rule, and restore it when this runs.

Priority: 30
Statement:
AndStatement:
Statements:
- NotStatement:
Statement:
GeoMatchStatement:
CountryCodes:
- US
- BR # TODO Until 2026-10-01
- RegexMatchStatement:
RegexString: "^(\\/wp-login\\.php)|(\\/wp-admin\\/)"
FieldToMatch:
UriPath: {}
TextTransformations:
- Priority: 0
Type: NONE
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: AdminKnownGeosOnly
Action:
Block: {}
Scope: CLOUDFRONT
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
Expand Down