By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Does AWSManagedRulesAmazonIpReputationList only look for BOTS?

0

We want to use the AWS WAF to block traffic from known bad IPs. However, when looking at the documentation and posts about the AWSManagedRulesAmazonIpReputationList rule set, it seems it only blocks identified BOTS, but doesn't distinguish between known malicious IPs and others. Is that correct? If so, does AWS have managed rules that can help me accomplish what I need?

Topics
Security, Identity, & Compliance
Tags
AWS WAF
Language
English
scot
asked a year ago1748 views
1 Answer
0

Hi Scot, inside of Amazon IP reputation List you can use 03 rules:

  • AWSManagedIPReputationList - Inspects for IP addresses that have been identified as bots.
  • AWSManagedReconnaissanceList - Inspects for connections from IP addresses that are performing reconnaissance against AWS resources.
  • AWSManagedIPDDoSList - Inspects for IP addresses that have been identified as actively engaging in DDoS activities.

All of these rules are based on AWS IP Reputation List rule group that are based on Amazon internal threat intelligence. https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html

In case that you want to control your own IP list you can create your own rules and rule groups. https://docs.aws.amazon.com/waf/latest/developerguide/waf-user-created-rule-groups.html

AWS
MHollanda
answered a year ago
  • scot
    a year ago

    My main question was related to AWSManagedIPReputationLIst. It appears you are not basing that on reputation at all, but just that something behaves like a BOT. I have seen others questioning this as well, identifying cases where legitimate BOTs, like ones owned by Google for indexing purposes, are being blocked. I really need something that is blocking known bad IPs, not just blocking all BOTs. Do you have a managed rule set that does that?

  • MHollanda
    a year ago

    Before using any managed rule group in production, it is recommended to test it in a non-production environment according to the guidance (https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-testing.html). Follow the testing and tuning guidance when you add a rule group to your web ACL, to test a new version of a rule group, and whenever a rule group isn't handling your web traffic as you need it to. Using this best practice you can evaluate if it is blocking any BOT IP that should not be blocked bases on your requirements.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content