Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise hosts a partner-only web portal behind an Application Load Balancer (ALB). To secure the portal, a Solutions Architect configures an AWS WAF Web ACL with a default action of 'Block'. The Web ACL contains two rules: a rule using an IP set to allow corporate partner network ranges, and a rate-based rule to block clients sending more than 2,000 requests per 5 minutes. The IP allowlist rule is currently evaluated first. During a security audit, a simulated HTTP flood from a partner's IP address successfully overwhelms the backend servers because the rate-based rule was not triggered. Which of the following changes should the Solutions Architect make to remediate this vulnerability?

  1. A
    Keep the IP allowlist rule evaluated first, but configure a scope-down statement within the IP allowlist rule that references the rate-based rule to dynamically exclude blocked IPs.
  2. Configure the rate-based rule with a higher evaluation priority (lower rule priority number) than the IP allowlist rule, ensuring the rate-based rule is evaluated first.Answer
  3. C
    Deploy a Service Control Policy (SCP) at the AWS Organizations Organizational Unit (OU) level that restricts the maximum request rate for the ALB, allowing the SCP to override local WAF rule evaluation.
  4. D
    Configure AWS-managed KMS key policies for the application's database to restrict API decryption rates, throttling the partner's traffic at the database layer instead.

Answer

Configure the rate-based rule with a higher evaluation priority (lower rule priority number) than the IP allowlist rule, ensuring the rate-based rule is evaluated first.
Evaluating the rate-based rule first ensures that any client exceeding the request threshold is blocked, regardless of whether their IP is on the corporate partner allowlist. Requests from partner IPs that do not exceed the rate limit will proceed to the next rule and be allowed.

Step-by-Step Solution

1
Analyze the existing WAF Web ACL rule evaluation flow.
Identify that the IP allowlist rule is currently evaluated first, and its 'Allow' action terminates rule evaluation for matching partner traffic, bypassing the rate-based rule.
AWS WAF processes rules sequentially. A terminating 'Allow' action stops further rule processing for that request.
2
Determine the required precedence for rate limiting.
Rate limiting must apply to all traffic, including partners, meaning the rate-based rule must take precedence over the allowlist.
To block HTTP floods from any source, the rate-based rule must evaluate before any terminating 'Allow' rule.
3
Reorder the rules in the Web ACL.
Move the rate-based rule to a higher priority (lower numeric priority value) than the IP allowlist rule.
This ensures that a client exceeding the rate limit is blocked by the rate-based rule first. Under-limit partner traffic then falls through to the IP allowlist rule and is allowed.

Key Concept

AWS WAF Web ACL rule evaluation order and action behaviors
Rate this question

Topics

Strengthening Identity, Access, and Network Security