AWS WAF Integration Guide

AWS WAF INTEGRATION

Implementation Guide

1. Prerequisites

Ensure the following conditions are met before beginning the implementation:

• An active AWS account with permissions to manage waf, S3, SQS and IAM.

• AWS Management Console access.

• The target S3 bucket region must match the WAF region.

• IAM administrator access or the ability to create IAM roles and attach policies.

2. Enable AWS WAF Logging

AWS WAF logging must be explicitly enabled on each Web ACL. WAF does not log by default.

2.1 Via AWS Console

1. Navigate to AWS WAF & Shield in the AWS Console

2. Select Web ACLs from the left navigation pane

1. Choose your Web ACL and click the Logging and metrics tab

2. Click Enable logging

1. Select <CentralizedS3Bucket> as the logging destination.

2. Click Save to activate logging

2.2 Create S3 Bucket

The S3 bucket serves as the primary log archive destination. The bucket must be created in the same region as the WAF.

Procedure

1. Sign in to the AWS Management Console and navigate to the S3 service.

2. Verify that the selected region matches the region of your WAF.

3. Click Create bucket.

4. Enter the bucket name: <bucket-name>

5. Leave all other settings at their defaults.

6. Click Create bucket to confirm.

2.3 Create SQS Queue

Procedure

1. Navigate to Amazon SQS in the same region as the S3 bucket.

2. Click Create queue.

3. Select Standard queue type.

4. Enter any queue name, for example aws-waf-logs-queue

5. Configure the following queue attributes:

• Visibility timeout: 15 minutes

• Receive message wait time: 20 seconds

1. Under Access policy, click Advanced and replace the default policy with the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3SendMessage",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:<region>:<account-id>:aws-waf-logs-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::<bucket-name>"
        }
      }
    }
  ]
}

NOTE: Replace and with your actual AWS region and 12-digit account ID before applying this policy.

1. Click Create queue.

2.4 Configure S3 Event Notifications

Procedure

1. Navigate to the S3 service and select the bucket created

2. Click the Properties tab.

3. Scroll to the Event notifications section and click Create event notification.

4. Configure the following settings:

• Event notification name: enter a descriptive name (e.g., waf-logs-put-event)

• Prefix: awswaflogs

• Event types: select PUT

• Destination: select SQS queue and choose aws-waf-logs-queue

1. Click Save changes.

2.5 Verify S3 Object Delivery

• Navigate to the S3 bucket: aws-waf-logs-dev

• Browse to the prefix: awswaflogs/year=YYYY/month=MM/day=DD/hour=HH/

• Confirm that compressed log files with extension .json.gz are present.

2.6 Verify SQS Notifications

• Navigate to Amazon SQS and select the queue: aws-waf-logs-queue

• Click Send and receive messages.

• Click Poll for messages and confirm that messages are present, indicating that S3 events are being delivered to the queue.

• Each message body should contain JSON with the s3.object.key of the newly created log file.