AWS CloudFront attached WAFv2 WebACL is not configured with AMR for Log4j Vulnerability misconfigura

AWS CloudFront attached WAFv2 WebACL is not configured with AMR for Log4j Vulnerability misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_47
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	MEDIUM
Framework	Terraform
Mapped CSPM/KSPM Rule	c8bbb7a9-c13a-482b-a0f3-96b4f5ff2ce0

Impact

This rule identifies AWS CloudFront attached with WAFv2 WebACL which is not configured with AWS Managed Rules (AMR) for Log4j Vulnerability. As per the guidelines given by AWS, CloudFront attached with WAFv2 WebACL should be configured with AWS Managed Rules (AMR) AWSManagedRulesKnownBadInputsRuleSet and AWSManagedRulesAnonymousIpList to protect from Log4j Vulnerability (CVE-2021-44228).

For more information please refer to https://aws.amazon.com/security/security-bulletins/AWS-2021-006/

How to Fix

Resource: aws_cloudfront_distribution, aws_wafv2_web_acl

• Arguments: rule.statement.managed_rule_group_statement.name [source,go]

---

resource "aws_cloudfront_distribution" "pass" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id }

enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html"

aliases = ["mysite.example.com", "yoursite.example.com"]

default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id

forwarded_values { query_string = false

cookies { forward = "none" } }

viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 }

Cache behavior with precedence 0

ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id

forwarded_values { query_string = false headers = ["Origin"]

cookies { forward = "none" } }

min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" }

price_class = "PriceClass_200"

restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } }

tags = { Environment = "production" }

viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.pass_acl.arn }

resource "aws_wafv2_web_acl" "pass_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL"

default_action { allow {} }

rule { name = "rule-1" priority = 1

override_action { count {} }

statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS"

excluded_rule { name = "SizeRestrictions_QUERYSTRING" }

scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } }

visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } }

rule { name = "rule-2" priority = 2

override_action { count {} }

statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS"

excluded_rule { name = "SizeRestrictions_QUERYSTRING" }

scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } }

visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } }

tags = { Tag1 = "Value1" Tag2 = "Value2" }

visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } }