WAF rule does not have any actions misconfiguration detected in code

WAF rule does not have any actions misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_342
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule ensures that the Web Application Firewall (WAF) rule has any actions set. The absence of actions in a WAF rule could lead to potential security vulnerabilities. WAF rules are intended to block, allow, or monitor (count) web requests based on conditions that you define. If a WAF rule has no actions set, it wouldn't be able to perform its function, leaving the application exposed to potential security threats. Therefore, this rule checks that there are actions defined in the WAF rule, enhancing the application's security.

How to Fix

Resource: aws_cloudfront_distribution

• Arguments: failover_criteria and origin_id

To fix this issue, you need to configure origin failover for your CloudFront distributions in your Terraform code and ensure you have two member parameters. [source,go]

resource "aws_cloudfront_distribution" "pass" { origin_group { origin_id = "groupS3"

• failover_criteria {
• status_codes = [403, 404, 500, 502]
• }
• member {
• origin_id = "primaryS3"
• }
• member {
• origin_id = "failoverS3"
• } }

origin { domain_name = aws_s3_bucket.primary.bucket_regional_domain_name origin_id = "primaryS3"

s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } }

origin { domain_name = aws_s3_bucket.failover.bucket_regional_domain_name origin_id = "failoverS3"

s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } }

default_cache_behavior {

... other configuration ...

target_origin_id = "groupS3" }

enabled = false restrictions {} viewer_certificate {} }