How do I use AWS WAF to block specific file extension uploads?

Short description

When you analyze the POST data of an HTTP request, uploaded content can be one of two types:

• Form data
• Binary

To restrict file uploads with specific extensions (.pdf, .docx, .exe), you'll create and configure a custom web access control list (web ACL) rule in AWS WAF.

Note: AWS WAF inspects the first 8 KB (8,192 bytes) of the request body. For information on larger body requests, see Oversize web request components in AWS WAF.

Resolution

Identify the type of content that the POST data uses

The POST data inside HTTP requests typically uses either form data or binary.

• Form data includes any data that a user enters on a web page or HTML form that HTTP sends or posts to a web server.
• A binary payload is anything other than a text payload. For example, a binary payload can be a .jpeg file, a .gzip file, or an .xml file. This includes generic binary data such as from a .pdf application, .jpeg image, or .zip application. For all file extension types, see Media types on the Internet Assigned Numbers Authority (IANA) website.

To identify your POST request type, check the Content-Type value in the HTTP POST header. For example:

Content-Type: multipart/form-data

Based on your Content-Type output, see the appropriate section that match your header value.

Create a rule for multipart/form-data content

Complete the following steps:

1. Open the AWS WAF console.

2. In the navigation pane, choose AWS WAF.

3. Choose Resources & protection packs.

4. Select your Protection pack.

5. In your selected protection pack, select Rules.

6. Select View and edit next to Rules to view or modify the rules associated with your protection pack.

7. In the right pane for Manage rules choose Add rules.

8. Choose Create new rule.

9. Choose Custom rule and select Next.

10. For Rule Type, choose Custom rule and select Next.

11. To set up your rule, configure the following values:
    For Action, choose Block for custom rules.
    For Name, enter a name to identify this rule.
    For If a request, choose matches the statement. Then, complete the following fields for the Statement:
    For Inspect, choose JSON Body.
    For JSON match scope, choose Values.
    For Action for invalid JSON body requests, choose the option appropriate for you.
    For Content to inspect, choose Full JSON content.
    For Match type, choose Matches regular expression.
    For Regular expression, enter a regex-pattern to match. See the following example:

    (?:.pdf|.doc|.docx|.ppt)

12. (Optional) For Text transformation, add a text transformation or keep these fields as None.

13. For Oversize Handling, choose the relevant option for your use case.

14. Choose Create Rule.

15. Choose Save.

Create a rule for binary value

Complete the following steps:

1. Open the AWS WAF console.

2. In the navigation pane, choose AWS WAF.

3. Choose Resources & protection packs.

4. Select your Protection pack.

5. In your selected protection pack, select Rules.

6. Select View and edit next to Rules to view or modify the rules associated with your protection pack.

7. In the right pane for Manage rules choose Add rules.

8. Choose Create new rule.

9. Choose Custom rule and select Next.

10. For Rule Type, choose Custom rule and select Next.

11. To set up your rule, configure the following values:
    For Action, choose Block for custom rules.
    For Name, enter a name to identify this rule.
    For If a request, choose matches the statement.
    Complete the following fields for the Statement:
    For Inspect, choose Single header.
    For Header field name, enter Content-Type.
    For Match type, choose Matches regular expression.
    For Regular expression, enter a regex-pattern to match.
    See the following example for .pdf and .jpeg files:

    (?:pdf|jpeg)

12. (Optional) For Text transformation, add a text transformation or keep these fields as None.

13. Choose Create Rule.

Note: To restrict the rule for a specific upload URI path, use an AND statement inside the web ACL rule that inspects the path.