WAF、Shield、Network Firewall

ネットワークセキュリティの多層防御

# Layer coverage:
# Network Firewall: Layer 3-7 VPC traffic (stateful)
# Shield Standard: Layer 3-4 DDoS (automatic, free)
# Shield Advanced: Layer 3-7 DDoS + response team
# WAF: Layer 7 HTTP/HTTPS (application attacks)

# Typical deployment:
# Internet -> CloudFront+WAF -> ALB+WAF -> EC2/ECS
# Network Firewall in VPC for egress/lateral inspection
# Shield protects all traffic automatically

AWS WAF：Web Application Firewall

# Create WAF Web ACL
aws wafv2 create-web-acl \
  --name 'prod-web-acl' \
  --scope CLOUDFRONT \
  --region us-east-1 \
  --default-action Allow={} \
  --rules '[{
    "Name": "AWSManagedRulesCommonRuleSet",
    "Priority": 1,
    "OverrideAction": {"None": {}},
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesCommonRuleSet"
      }
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "CommonRuleSet"
    }
  }]' \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=web-acl-metrics

WAFマネージドルールグループ

# Add IP reputation list managed rule group
aws wafv2 update-web-acl \
  --name 'prod-web-acl' \
  --scope CLOUDFRONT \
  --id <acl-id> \
  --lock-token <lock-token> \
  --rules '[{
    "Name": "AWSManagedRulesAmazonIpReputationList",
    "Priority": 0,
    "OverrideAction": {"None": {}},
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesAmazonIpReputationList"
      }
    }
  }, ...existing_rules...]'

WAFのレートベースルール

# Create rate-based rule for login endpoint
aws wafv2 update-web-acl \
  --rules '[{
    "Name": "RateLimitLogin",
    "Priority": 2,
    "Action": {"Block": {}},
    "Statement": {
      "RateBasedStatement": {
        "Limit": 100,
        "AggregateKeyType": "IP",
        "ScopeDownStatement": {
          "ByteMatchStatement": {
            "SearchString": "/api/login",
            "FieldToMatch": {"UriPath": {}},
            "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
            "PositionalConstraint": "STARTS_WITH"
          }
        }
      }
    }
  }]'

AWS Shield StandardとAdvanced

# Enable Shield Advanced protection on ALB
aws shield create-protection \
  --name 'prod-alb-protection' \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123:loadbalancer/app/prod-alb/abc

# Associate with a WAF Web ACL for layer-7 protection
aws shield associate-drt-log-bucket \
  --log-bucket my-shield-logs

# With Shield Advanced:
# - DDoS events detected and mitigated automatically
# - DRT can tune WAF rules during active attacks
# - Real-time CloudWatch dashboard
# - AWS will refund EC2/ELB/CloudFront scaling costs from DDoS

AWS Network Firewall

# Create Network Firewall
aws network-firewall create-firewall \
  --firewall-name prod-vpc-firewall \
  --firewall-policy-arn arn:aws:network-firewall:us-east-1:123:firewall-policy/my-policy \
  --vpc-id vpc-12345 \
  --subnet-mappings '[{"SubnetId":"subnet-firewall-AZ1"},{"SubnetId":"subnet-firewall-AZ2"}]'

# Network Firewall topology:
# Internet -> IGW -> Firewall subnet (Network FW) -> App subnet
# Egress: App subnet -> Firewall subnet (Network FW) -> IGW -> Internet

Network Firewallのルールグループ

# Create domain list rule group (egress filtering)
aws network-firewall create-rule-group \
  --rule-group-name 'allow-egress-domains' \
  --type STATEFUL \
  --capacity 100 \
  --rules-source '{
    "RulesSourceList": {
      "Targets": [
        "amazonaws.com",
        "example.com",
        "*.npmjs.com"
      ],
      "TargetTypes": ["HTTP_HOST","TLS_SNI"],
      "GeneratedRulesType": "ALLOWLIST"
    }
  }'

# Block all other egress traffic by default
# Prevents EC2 from calling malicious external domains

WAF、Shield、Network Firewallの比較

# Comparison table:
# Service          Scope     Layer  Use Case
# AWS WAF          Edge/ALB  7      App attacks, rate limits, bots
# Shield Standard  All       3-4    Auto DDoS mitigation (free)
# Shield Advanced  All       3-7    Enhanced DDoS + DRT support
# Network Firewall VPC       3-7    Stateful inspection, IPS, egress

# SAA-C03 exam keywords:
# 'SQL injection protection' -> WAF
# 'DDoS protection' -> Shield
# 'Block EC2 from calling external IPs' -> Network Firewall
# 'Block requests from country X' -> WAF geo-match

WAFのログ記録と分析

# Enable WAF logging to Kinesis Firehose
aws wafv2 put-logging-configuration \
  --logging-configuration '{
    "ResourceArn": "arn:aws:wafv2:us-east-1:123:global/webacl/prod-web-acl/abc",
    "LogDestinationConfigs": [
      "arn:aws:firehose:us-east-1:123:deliverystream/waf-logs"
    ],
    "LoggingFilter": {
      "DefaultBehavior": "KEEP",
      "Filters": [{
        "Behavior": "KEEP",
        "Conditions": [{"ActionCondition":{"Action":"BLOCK"}}],
        "Requirement": "MEETS_ANY"
      }]
    }
  }'

WAF のデプロイアーキテクチャパターン

# WAF attachment points:
# 1. CloudFront distribution (global edge, CLOUDFRONT scope)
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:123:global/webacl/my-acl/abc \
  --resource-arn arn:aws:cloudfront::123:distribution/EXAMPLEID

# 2. ALB (regional, REGIONAL scope)
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:123:regional/webacl/my-acl/xyz \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123:loadbalancer/app/my-alb/abc

# 3. API Gateway REST API
# 4. AppSync GraphQL API
# 5. Amazon Cognito User Pool

マルチアカウント WAF のための Firewall Manager

# Create Firewall Manager WAF policy
aws fms put-policy \
  --policy '{
    "PolicyName": "org-wide-waf-policy",
    "SecurityServicePolicyData": {
      "Type": "WAFV2",
      "ManagedServiceData": "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"managedRuleGroupIdentifier\":{\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"excludeRules\":[],\"ruleGroupType\":\"ManagedRuleGroup\"}]}"
    },
    "ResourceType": "AWS::ElasticLoadBalancingV2::LoadBalancer",
    "IncludeMap": {"ACCOUNT": []},
    "ExcludeResourceTags": false,
    "RemediationEnabled": true
  }'

クイックチェック

レッスンのまとめ