Uly.me

cloud engineer

Cloud

WAF CloudFormation Template

Here’s the CloudFormation template for creating a WAF.

Here are some options that you’ll be asked during creation.

  • Activate SQL Injection Protection ( yes | no )
  • Activate Cross-site Scripting Protection ( yes | no )
  • Activate HTTP Flood Protection ( WAF rate | Lambda log parser | Athena log parser | no )
  • Activate Scanner & Probe Protection ( Lambda log parser | Athena log parser | no )
  • Activate Reputation List Protection ( yes | no )
  • Activate Bad Bot Protection ( yes | no )
  • Endpoint Type (CloudFront or ALB)
  • Application Access Log Bucket Name ( Leave blank if no S3 bucket)

The template creates 2 CloudFormation stacks.

AWS WAF IP Set

Here’s how to get the WAF rule.

aws waf-regional get-rule \
--rule-id xxxxxxxxxxxxxxxxxxxxxxxxxxx

Here’s how to get the AWS WAF IP set.

aws waf-regional get-ip-set \
--ip-set-id xxxxxxxxxxxxxxxxxxx \
--region us-east-1 \
--profile your-profile

Here’s how to get the latest token.

aws waf-regional get-change-token

Result is similar to this.

{
    "ChangeToken": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Create a JSON file called “change.json” to be used for updating the IP set. We will insert and delete an IP set.

[
    {
        "Action": "INSERT",
        "IPSetDescriptor":
        {
            "Type": "IPV4",
            "Value": "12.34.56.78/24"
        }
    },
    {
        "Action": "DELETE",
        "IPSetDescriptor":
        {
            "Type": "IPV6",
            "Value": "1111:0000:0000:0000:0000:0000:0000:0111/128"
        }
    }
]

Finally, here’s how to update the IP set.

aws waf-regional update-ip-set \
--ip-set-id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
--change-token xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
--region us-east-1 \
--profile default \
--updates file://change.json

Video Conferencing

Due to the Covid-19 lockdown, here are several video conferencing options.

  • Microsoft Skype – been around for a long time.
  • Microsoft Teams – Microsoft wants everyone to switch to Teams.
  • Google Meet – Uses the webRTC protocol. Video calls up to 10 people.
  • Discord – Popular with gamers. Video chat capable up to 9 people.
  • Zoom – Got really hot, then took a dive due to zoombombing.
  • Chime – Amazon Web Services video chat.
  • Webex – Cisco’s video conferencing.

This is not an extensive list, but are the popular options.

Believe it or not, I have all on my work laptop except for Discord.

S3 Browser IAM Assume Role

S3 Browser is a free Windows client for accessing AWS S3 buckets. You can access S3 buckets with an interface similar to File Manager. A typical setup requires that you use access and secret keys to connect to the S3 browser. However, if the server is in the cloud, it’s better that use a machine profile with an assume role. The assume role gets temporary credentials until they expire. They are automatically rotated by AWS behind the scenes for you. This is much safer process than storing key credentials in the cloud. The good news is, S3 Browser support IAM assume roles. Here’s the setup instructions to get your S3 Browser configured using IAM assume role. Here’s IAM role explained.

AWS S3 LS Recursive

Here’s how to list S3 files recursively.

aws s3 ls s3://mybucket --recursive | awk '{print $4}'

By default, the results display date, time, disk size and filename. Use awk to display the filename only.