📄 Host-Based WAF Rule for ALB

🎯 Objective

Block unwanted or bot traffic hitting the ALB directly via its AWS DNS name or public IP, while only allowing requests that use the valid application domain (solutions.example.co.in).

Benefits:

• Reduces 4XX noise in CloudWatch
• Protects the application from direct scanning attempts

🔧 Approach

• Use AWS WAF v2 Web ACL attached to the ALB.
• Create a ByteMatch rule that inspects the Host header.
• Allow requests only if the Host header exactly matches solutions.example.co.in.
• Block everything else by setting the Web ACL default action to Block.

✅ Rule Definition (JSON)

{
  "Name": "AllowSolutionsHost",
  "Priority": 7,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AllowSolutionsHost"
  },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": {
        "SingleHeader": {
          "Name": "host"
        }
      },
      "PositionalConstraint": "EXACTLY",
      "SearchString": "solutions.example.co.in",
      "TextTransformations": [
        {
          "Type": "LOWERCASE",
          "Priority": 0
        }
      ]
    }
  }
}

⚙️ Configuration Steps

1. Navigate to AWS WAF → Web ACLs.
2. Edit the Web ACL attached to your ALB.
3. Add a new Rule → Rule builder → Custom request rule.
4. Paste the JSON above or configure equivalent settings in the console.
5. Set the Web ACL default action to Block.
6. Place this rule at a higher priority than any managed rules.
7. (Optional) Add additional Allow rules for other valid domains (e.g., api.example.co.in).

🛡️ Best Practices

• Start in COUNT mode before enforcing to ensure no valid traffic is accidentally blocked.
• If using multiple domains, define an OR condition or add separate rules for each.
• Retain AWS Managed Rules (e.g., AWSManagedRulesCommonRuleSet) after the Host header rule for additional protection.
• Monitor CloudWatch metrics for this rule to verify effectiveness.

🔍 Validation

Run test requests:

curl -H "Host: solutions.example.co.in" https://<ALB-DNS>    # ✅ Allowed
curl https://<ALB-IP>                                         # ❌ Blocked
curl https://<ALB-DNS>                                        # ❌ Blocked if Host header invalid

• Query Athena ALB logs post-deployment to confirm only valid Host requests pass through.

🎯 Expected Outcome

• Bots and scanners hitting the ALB via IP or AWS-assigned DNS are blocked at the WAF layer.
• Only legitimate traffic using solutions.example.co.in is processed.
• CloudWatch 4XX error alarms show reduced false positives from bot noise.