> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# WafCloudfrontSecurity

# 📄 Host-Based WAF Rule for ALB

## 🎯 Objective

Block unwanted or bot traffic hitting the ALB directly via its AWS DNS name or public IP, while only allowing requests that use the valid application domain (`solutions.example.co.in`).

Benefits:

* Reduces 4XX noise in CloudWatch
* Protects the application from direct scanning attempts

***

## 🔧 Approach

* Use **AWS WAF v2 Web ACL** attached to the ALB.
* Create a **ByteMatch rule** that inspects the `Host` header.
* **Allow** requests only if the `Host` header exactly matches `solutions.example.co.in`.
* **Block everything else** by setting the Web ACL default action to `Block`.

***

## ✅ Rule Definition (JSON)

```json theme={null}
{
  "Name": "AllowSolutionsHost",
  "Priority": 7,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowSolutionsHost"
  },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": {
        "SingleHeader": {
          "Name": "host"
        }
      },
      "PositionalConstraint": "EXACTLY",
      "SearchString": "solutions.example.co.in",
      "TextTransformations": [
        {
          "Type": "LOWERCASE",
          "Priority": 0
        }
      ]
    }
  }
}
```

***

## ⚙️ Configuration Steps

1. Navigate to **AWS WAF → Web ACLs**.
2. Edit the Web ACL attached to your ALB.
3. Add a **new Rule → Rule builder → Custom request rule**.
4. Paste the JSON above or configure equivalent settings in the console.
5. Set the Web ACL **default action** to `Block`.
6. Place this rule at a **higher priority** than any managed rules.
7. *(Optional)* Add additional Allow rules for other valid domains (e.g., `api.example.co.in`).

***

## 🛡️ Best Practices

* Start in **COUNT mode** before enforcing to ensure no valid traffic is accidentally blocked.
* If using multiple domains, define an **OR condition** or add separate rules for each.
* Retain **AWS Managed Rules** (e.g., `AWSManagedRulesCommonRuleSet`) after the Host header rule for additional protection.
* Monitor **CloudWatch metrics** for this rule to verify effectiveness.

***

## 🔍 Validation

Run test requests:

```bash theme={null}
curl -H "Host: solutions.example.co.in" https://<ALB-DNS>    # ✅ Allowed
curl https://<ALB-IP>                                         # ❌ Blocked
curl https://<ALB-DNS>                                        # ❌ Blocked if Host header invalid
```

* Query **Athena ALB logs** post-deployment to confirm only valid Host requests pass through.

***

## 🎯 Expected Outcome

* Bots and scanners hitting the ALB via IP or AWS-assigned DNS are **blocked at the WAF layer**.
* Only legitimate traffic using `solutions.example.co.in` is processed.
* **CloudWatch 4XX error alarms** show reduced false positives from bot noise.