We changed the rule action from blocking to counting, i.e., keeping the rule alive but only counting the number of traffic that corresponds to the rule.

To confirm, change the action of the geo-restriction. The URL to be accessed this time is determined by a combination of resource and stage information.īecause you accessed it from Japan, it means that it was blocked by the WAF Web ACL before reaching the API Gateway. Now that everything is ready, access CloudFront from Japan. If you see the stage page, you will see that WAF is applied.įrom the Web ACL side, you can also see that this ACL is applied to API Gateway. We will also check the resource from the AWS Management Console.

API Gateway resource name: fa-053-resource.

Create CloudFormation stacks and check resources in stacksįor information on how to create stacks and check each stack, please refer to the following pageĪfter checking the resources in each stack, information on the main resources created this time is as follows Use CloudFormation to build this environment and check the actual behavior. So to meet the above requirements, we use the built-in function Fn::Sub to embed and configure the API’s ID and stage name.

The following is a description of how to specify the WAFįor an Amazon API Gateway REST API: arn:aws:apigateway:region::/restapis/api-id/stages/stage-name AWS::WAFv2::WebACLAssociation

In the ResourceArn property, specify the API Gateway to which WAF is to be applied.

Resource for applying WAF to API Gateway. Resources: RestApi: Type: AWS::ApiGateway::RestApi Properties: EndpointConfiguration: Types: - EDGE Name: !Ref Prefix Deployment: Type: AWS::ApiGateway::Deployment DependsOn: - Method Properties: RestApiId: !Ref RestApi Resource: Type: AWS::ApiGateway::Resource Properties: ParentId: !GetAtt RestApi.RootResourceId PathPart: !Sub '$' WebACLArn: !GetAtt WebACL.Arn Code language: YAML ( yaml )

Aws waf api gateway