Using aws waf with mq

Question

Pulumi · Accepted Answer

AWS WAF (Web Application Firewall) can help mitigate security risks by allowing you to create custom rules that block common attack patterns, such as SQL injection or cross-site scripting. While AWS WAF is commonly used with web applications, it can also offer protection for other AWS services.

Amazon MQ is a managed message broker service for Apache ActiveMQ and RabbitMQ that makes it easy to set up and operate message brokers on AWS.

However, AWS WAF cannot be directly applied to Amazon MQ as it is designed to protect HTTP-based services (like Amazon API Gateway, Amazon CloudFront, and Application Load Balancer).

To indirectly use AWS WAF to protect an MQ broker, you could place an Application Load Balancer (ALB) in front of your broker, exposed via an HTTP API, and then attach WAF to the ALB. This is a complex and non-standard implementation and typically only recommended if you have web clients interacting with Amazon MQ through a web sockets connection.

If you are dealing with a scenario where your MQ needs to be protected by WAF through an ALB, the following Pulumi TypeScript program illustrates how you might set up an ALB in front of Amazon MQ, and then apply a WAF WebACL to it:

import * as aws from "@pulumi/aws";

// Create a new WAF IP set
const wafIpSet = new aws.wafv2.IpSet("wafIpSet", {
    addresses: [
        "1.2.3.4/32",
        "5.6.7.8/32",
    ],
    scope: "REGIONAL",
    ipAddressVersion: "IPV4",
});

// Create a new WAF Rule Group
const wafRuleGroup = new aws.wafv2.RuleGroup("wafRuleGroup", {
    capacity: 50,
    scope: "REGIONAL",
    rules: [{
        name: "rule1",
        priority: 1,
        action: {
            allow: {},
        },
        statement: {
            ipSetReferenceStatement: {
                arn: wafIpSet.arn,
            },
        },
        visibilityConfig: {
            cloudwatchMetricsEnabled: false,
            metricName: "rule1",
            sampledRequestsEnabled: false,
        },
    }],
});

// Create a new Application Load Balancer
const alb = new aws.lb.LoadBalancer("appLoadBalancer", {
    internal: false,
    loadBalancerType: "application",
    subnets: [
        // List subnets here
    ],
    securityGroups: [
        // List security groups here
    ],
});

// Create a target group for the MQ Broker
const mqTargetGroup = new aws.lb.TargetGroup("mqTargetGroup", {
    port: 80,
    protocol: "HTTP",
    targetType: "ip",
    vpcId: "<VPC-Id>",
});

// Create a listener for the Application Load Balancer that forwards to the MQ Target Group
const albListener = new aws.lb.Listener("albListener", {
    loadBalancerArn: alb.arn,
    port: 80,
    defaultActions: [{
        type: "forward",
        targetGroupArn: mqTargetGroup.arn,
    }],
});

// Associate the WAF Rule Group with the Application Load Balancer
const wafWebAcl = new aws.wafv2.WebAcl("wafWebAcl", {
    scope: "REGIONAL",
    defaultAction: {
        allow: {},
    },
    rules: [{
        name: "ruleGroup",
        priority: 1,
        overrideAction: {
            count: {},
        },
        statement: {
            ruleGroupReferenceStatement: {
                arn: wafRuleGroup.arn,
            },
        },
        visibilityConfig: {
            cloudwatchMetricsEnabled: true,
            metricName: "ruleGroup",
            sampledRequestsEnabled: true,
        },
    }],
    visibilityConfig: {
        cloudwatchMetricsEnabled: true,
        metricName: "webAcl",
        sampledRequestsEnabled: true,
    },
    // Bind the Web ACL to the ARN of the Application Load Balancer
    resourceArn: alb.arn,
});

// Output the DNS name of the Load Balancer
export const albDnsName = alb.dnsName;

In this program:

We create a WAF IP set to define a set of allowable source IP addresses.
We define a WAF Rule Group with a single rule to allow requests from the specified IP addresses.
An Application Load Balancer (ALB) is set up with listeners to redirect traffic to a target group.
The target group is associated with the ALB and is where the Amazon MQ broker would be targeted if you have an HTTP interface in front of MQ.
We then create a Web ACL that uses the WAF Rule Group and associate with the ALB using resourceArn.

Please note, the assumption here is that the ALB is added in front of an HTTP interface to Amazon MQ, which is something you'll have to implement as AWS WAF cannot be directly attached to the Amazon MQ service.

Remember to replace placeholders within the code (like // List subnets here and <VPC-Id>) with actual values from your AWS environment.

Important Consideration: This program is a conceptual representation. In a real-world scenario, the use of Amazon MQ via HTTP and an ALB could introduce latency and other issues. Generally, Amazon MQ is accessed through messaging protocols such as AMQP, MQTT, OpenWire, STOMP, and JMS, which are not HTTP-based and as such not compatible with AWS WAF. Always carefully consider the architecture and the implications of introducing such components to your stack.