Our team created a Web ACL with rules defined for attach patterns of web traffic. Rule groups were created for reusable collection of rules.

• Web ACL setup for ALB – Managed Rule Groups
  • Admin protection – contains rules that allow blocking external access to admin pages
  • Amazon IP reputation list – contains rules based on Amazon threat intelligence, which helps to block sources associated with bots or other threats
  • Anonymous IP list – used to filter out viewers that may try to hide their identity from your applications (e.g.: block requests from VPN, proxies, Tor nodes, and hosting providers)
  • Core rule set – generally applicable to web applications. This provides protection against a wide range of vulnerabilities including those described in OWASP publications
  • Known bad inputs – rules that allow blocking request patterns that are known to be invalid and associated with exploitations
  • Linux operating systems – rules that block request patterns associated with exploitation of vulnerabilities specific to Linux. Prevent file content exposure and execution of codes by attackers.