在 AWS 上使用 WAF 實作 SQL Injection 防護

# waf 設置

resource "aws_wafv2_web_acl" "demo" {
  name        = "waf-demo"
  description = "Demo WAF with IP deny + SQLi"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "waf-demo"
    sampled_requests_enabled   = true
  }

  rule {
    name     = "sqli_protection"
    priority = 2
    override_action {
      none {}
    }

    statement {
      # aws wafv2 list-available-managed-rule-groups --scope=REGIONAL
      managed_rule_group_statement {
        name        = "AWSManagedRulesSQLiRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "sqli_protection"
      sampled_requests_enabled   = true
    }
  }
}

# mock api-gateway

resource "aws_api_gateway_rest_api" "demo" {
  name        = "waf-test-api"
  description = "REST API for WAF demo"
}

resource "aws_api_gateway_resource" "test" {
  rest_api_id = aws_api_gateway_rest_api.demo.id
  parent_id   = aws_api_gateway_rest_api.demo.root_resource_id
  path_part   = var.api_path
}

resource "aws_api_gateway_method" "get" {
  rest_api_id   = aws_api_gateway_rest_api.demo.id
  resource_id   = aws_api_gateway_resource.test.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_integration" "mock" {
  rest_api_id   = aws_api_gateway_rest_api.demo.id
  resource_id   = aws_api_gateway_resource.test.id
  http_method   = aws_api_gateway_method.get.http_method
  type          = "MOCK"

  request_templates = {
    "application/json" = "{ \"statusCode\": 200 }"
  }
}

resource "aws_api_gateway_method_response" "get_200" {
  rest_api_id = aws_api_gateway_rest_api.demo.id
  resource_id = aws_api_gateway_resource.test.id
  http_method = aws_api_gateway_method.get.http_method
  status_code = "200"
  response_models = {
    "application/json" = "Empty"
  }
}

resource "aws_api_gateway_integration_response" "get_200" {
  rest_api_id = aws_api_gateway_rest_api.demo.id
  resource_id = aws_api_gateway_resource.test.id
  http_method = aws_api_gateway_method.get.http_method
  status_code = aws_api_gateway_method_response.get_200.status_code
  response_templates = {
    "application/json" = <<EOF
{
  "message": "Hello from MOCK!"
}
EOF
  }
}

resource "aws_api_gateway_deployment" "demo" {
  rest_api_id = aws_api_gateway_rest_api.demo.id

  depends_on = [
    aws_api_gateway_integration.mock
  ]
}

resource "aws_api_gateway_stage" "demo" {
  rest_api_id   = aws_api_gateway_rest_api.demo.id
  deployment_id = aws_api_gateway_deployment.demo.id
  stage_name    = var.api_stage
}

# main.tf

terraform {
  required_version = "~> 1.12"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.9.0"
    }

    http = {
      source  = "hashicorp/http"
      version = "3.5.0"
    }
  }

  backend "s3" {
    bucket              = "bucket-name"
    key                 = "lab/infra/waf.tfstate"
    allowed_account_ids = ["5xxxxxxxxxx0"]
    region              = "ap-northeast-1"
    dynamodb_table      = "tf-locks"
    profile             = "tf-profile"
  }
}


provider "aws" {
  region              = "ap-northeast-1"
  profile             = "tf-profile"
  allowed_account_ids = ["5xxxxxxxxxx0"]

  default_tags {
    tags = {
      Managed = "terraform"
      Source  = "lab/infra/waf"
    }
  }
}

# 嘗試 union 查詢
curl "https://{api-gateway-id}.execute-api.ap-northeast-1.amazonaws.com/dev/test?id=1%20UNI0N&20SELECT&20*&20FROM&20users"

# 單純 select "1"
curl "https://{api-gateway-id}.execute-api.ap-northeast-1.amazonaws.com/dev/test?id=1"

aws wafv2 list-available-managed-rule-groups --scope=REGIONAL

Error reason: You exceeded the capacity limit for a rule group or web ACL., field: RULE_GROUP, parameter: 22