Can Cloudwatch alarm trigger WAF for ALB?

0

Is it possible to automatically trigger WAF on an ALB if a certain condition is met on a CloudWatch alarm? And also turn it off again, if condition not met anymore (based status change on alarm).

When I'm editing an alarm on CloudWatch, there is only Lambda/Auto Scaling/Ec2 Action/System Manager, but nothing about such use case. Would I have to create a lambda function?

Ty.

已提問 2 個月前檢視次數 71 次
3 個答案
1
已接受的答案

There is no direct integration between CloudWatch alarms and WAF, so you need a Lambda function as an intermediary. Set up a CloudWatch alarm for your specific condition, then create a Lambda function capable of modifying WAF rules or WebACL associations. Use EventBridge to trigger this Lambda function when the alarm state changes. The Lambda function will check the alarm state and, based on that, it can associate or dissociate the WebACL to or from the ALB accordingly.

AWS
已回答 2 個月前
profile picture
專家
已審閱 2 個月前
1

Hello, please take a look at this blog post (plus associated sample code) - this might take some of the heavy lifting out of what you're trying to do. https://aws.amazon.com/blogs/networking-and-content-delivery/how-to-dynamically-adapt-your-response-to-changing-threat-levels-using-aws-waf/

AWS
專家
已回答 2 個月前
1

Hi, please note that in the answer above the statement "Use EventBridge to trigger this Lambda function when the alarm state changes" is not mandatory: you can invoke a Lambda function directly from the alarm, without the need to go through EventBridge. How you invoke the Lambda function is your choice: a direct integration between the alarm and the Lambda simplifies the architecture at the tradeoff of simply having to manage alarm permissions more granularly.

profile pictureAWS
已回答 2 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南