Each IPSet is capable of supporting 10,000 IP Addresses/CIDRs. Each rule can have multiple predicates (IPSet Match Groups) using the ‘OR’ operator.

Amazon limits Web ACLs (v2) to 100 rules per region.

S3 costs to store logs and retrieve logs if logging is enabled.Ĭonfiguration done through ThreatSTOP Centralized Manager (TSCM) VM Command line interface (CLI), AWS Identity Access ID & Secret stored on VM onlyĬonfiguration done through ThreatSTOP Admin portal, AWS Identity Access ID & Secret stored on VM onlyĬonfiguration done through ThreatSTOP Admin portal, Supports both Identity and Role based access stored in Admin portal.

the costs of the WAF rules (WAF WebACL subscription, IPSet rules, number of web requests processed by the Web ACL).

The AWS costs associated with the integration are tied to the account containg the WAF and S3 buckets. This means we will default block IPSets with (our test block IP Address) 64.87.3.133/32 and default allow IPSets with 192.124.129.42/32. Please note that in a recent change, Amazon has removed the ability to creating empty IPSets. If you current AWS Infrastructure uses WAF-Classic, please see this document. Note: This document pertains to AWS’s WAF version 2.

Enabling DNS Defense Cloud on Windows Server.

Cisco ASA via REST API (TSCM Web Automation).

Cisco ASA via SSH (TSCM Web Automation).

Valid options: CLOUDFRONT, REGIONAL.Ī mapping of tags to assign to the WAFv2 ACL. Currently supports a single header type and multiple header values. Whether to associate Logging resource with the WAFv2 ACL.

The action to perform if none of the rules contained in the WebACL match.

Whether to associate an ALB with the WAFv2 ACL. arnĪws_wafv2_web_acl_logging_configuration.mainĪRN of the ALB to be associated with the WAFv2 ACL.

Wafv2