How do I sanitize AWS WAF logging?

Short description

With AWS WAF log filtering, you can filter logged web requests to keep only the information that you want to analyze. You can specify whether web requests are logged or discarded from log after the inspection. This saves on log delivery and storage costs because AWS WAF only publishes the logs that you require.

To filter AWS WAF logs, first turn on AWS WAF logging.

To sanitize your logs, implement field redaction and log filtering.

Field redaction: Redact parts of the request that you want to keep out of the logs. You can omit the following fields from your log records: URI path, Query string, Single header, and HTTP method. Redacted fields appear as REDACTED in the logs.

Log filtering: Specify filter conditions to filter out log entries based on rule actions or labels generated by rules during evaluation. To filter AWS WAF logs for all requests that contain a label, you include all labels that use a fully qualified label name. Use the following format: awswaf:account_number:webacl:webacl_name:namespace:label name.

Note: There's no additional charge for you to use AWS log filtering. However, charges do apply for logging destinations. This includes Amazon CloudWatch, Amazon Simple Storage Service (Amazon S3) buckets, and Amazon Data Firehose delivery streams.

Use the AWS WAF console to turn on AWS WAF log filtering

1. Open the AWS WAF console.
2. For Region, choose the AWS region where you created your protection pack.
3. In the navigation pane, choose Resources & protection packs.
4. On the right side of protection pack, select the icon next to region name to choose the protection pack.
5. In your selected protection pack, select Logging.
6. Select View and edit next to Logging to view or modify the Logging configuration associated with this protection pack.
7. Under Data protection settings, choose active.
8. Under Scope select Logging destination only.
9. Choose the destination type and Cloudwatch log group.
10. For Redacted Fields, select the fields that you want to omit from the logs.
    Note: Specify custom headers if you want to redact a single header field.
11. For Filter conditions, select either Rule Action on request or Request has label.
    For Rule Action on request, select a rule action for AWS WAF logs to filter by. For example: Allow, Block, Count, CAPTCHA, or Challenge.
    For Request has label, enter the label added to AWS WAF while evaluating requests.
12. For Filter behavior, choose either Keep in logs or Drop from logs.
13. For either Keep in logs or Drop from logs, select the default logging behavior.
14. Choose Save.

Use AWS Command Line Interface (AWS CLI) to turn on AWS WAF log filtering

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

1. To get your current logging configuration, run get-logging-configuration:

   aws wafv2 get-logging-configuration --region region--resource-arn arn:aws:wafv2:region:account_number:regional/webacl/webacl_name/webacl_id > waf.json

   Note: Replace region with your web ACL's AWS Region, resource-arn with your web ACL's Amazon Resource Name (ARN), and webacl_name your web ACL's name.
2. Open the logging configuration file and then add the following JSON filters:

   "LoggingFilter": { 
       "DefaultBehavior": "string",
       "Filters": [ 
       { 
           "Behavior": "string",
           "Conditions": [ 
               { 
                   "ActionCondition": { 
                   "Action": "string"
                   },
                   "LabelNameCondition": { 
                   "LabelName": "string"
                   }
               }
           ],
           "Requirement": "string"
       }
   ]
   }

   Note: Replace the filters and filter actions with your required filters.
3. To update your logging configuration, run put-logging-configuration:

   aws wafv2 put-logging-configuration --region region --cli-input-json file://waf.json

   Note: Replace region with your web ACL's Region.

Log only blocked requests

To log only the requests blocked by AWS WAF, select filtering based on Rule Action and then set the action to Block. Block is a terminating action in AWS WAF. AWS WAF log filters check the terminating rule action of AWS WAF log entries. If the action is Block, then the AWS WAF log filters add the entry to the log.

Log the Count requests from a rule group

The way a rule in a rule group is set determines whether the logs filter count requests.

The action for a rule in a rule group is set to Count: Logs for the request matching against this rule don't contain a Count action. Instead, the AWS WAF logs show this rule under the excludedRules field. AWS WAF doesn't check this field the AWS WAF logs are filtered for Count. This means that these requests won't be filtered by the log filtering for the Count action.

A rule with the non-terminating action Count is inspected along with a terminating rule action such as Allow or Block: AWS WAF logs include these requests in logs filtered by the Count action.

The action for a rule in a rule group is set to Override to Count: For these requests, the AWS WAF log contains a Count action in the nonTerminatingMatchingRules field. AWS WAF log filters check this field, so the rule is filtered by the Count action.

Note: EXCLUDED_AS_COUNT is a valid action type for log filtering. Run the put-logging-configuration command to configure this action.

Related information

LoggingFilter

Working with the updated console experience

Logging AWS WAF protection pack or web ACL traffic