search

aws-solutions / aws-waf-security-automations

This solution automatically deploys a single web access control list (web ACL) with a set of AWS WAF rules designed to filter common web-based attacks.
https://aws.amazon.com/solutions/aws-waf-security-automations
Apache License 2.0
843 stars 361 forks source link

log parser not working for scans and probes #129

Closed sudhir05 closed 4 years ago

sudhir05 commented 4 years ago

I have recently attached aws-waf-security-automation with cloudfront and wanted to test scans and probes scenario. Facing below issues:

  1. I was hitting an API end point more than 100 time which returned 401. According to the rule originating IP should be added in the block list. But i cannot see any ip in the scans and probe list. There is no lambda log group also created for scans and probes. I could see log group created for few other rules.
  2. I haven't enabled logging however bucket is in place.
aijunpeng commented 4 years ago

Can you please provide the following information:

  1. Did you deploy a new stack or update an existing stack? If it was updating stack, what parameters were updated?
  2. What are the version of the solution and input parameter values of your current WAF stack?
aijunpeng commented 4 years ago
  1. Verify that your cloudfront logs are linked to the WAF AppAccessLogBucket s3 bucket and provide a screenshot of your WAF AppAccessLogBucket s3 bucket with cloudfront logs in it.
  2. WAF solution should automatically create lambda log group for you. You can go to your LogParser lambda function in AWS console and open cloudwatch logs for the function there.
sudhir05 commented 4 years ago

@aijunpeng thanks for your response. I could see cloudwatch log group has been generated for log parser. However i haven't tested again with Scan and Probes.

aijunpeng commented 4 years ago

ok. let us know if there are issues.