4 ms·

WAF seems to be an essential piece for any website with even a little bit of visibility / traffic on the net. Some questions: * Comparison of AWS WAF vs Cloudf

WAF seems to be an essential piece for any website with even a little bit of visibility / traffic on the net. Some questions: * Comparison of AWS WAF vs Cloudflare vs Others? * Many services like EC2 charge for data transfer [1], so how much of your monthly/yearly costs of hosting goes toward fending scans like these? Does AWS count any traffic blocked by the WAF toward the transfer limits? -- 1: https://aws.amazon.com/ec2/pricing/on-demand/ https://aws.amazon.com/ec2/pricing/on-demand/

rfmoz 3y ago
With Fastly WAF - SignalSciences, Distil Networks - Imperva, Akamai - StackPath. There are a few companies that started alone in this ecosystem and found the evolution path with the mayor CDN networks, those who have failed themselves in provide a good internal alternative service. Human security - PerimeterX, Haproxy WAF, Datadome, are other players to different target audience. If you have a good control over the app exposed, maybe you only need a WAF in the sense of stop stuff outside your infra. The sql injections, weird urls trying the way to /etc/passwd or related things look from the past and only makes noise nowadays. The real issue is when someone hits you in a rate impossible to manage with your resources or when it cost you more than the securing layer.
nickjj 3y ago
If you're on AWS the AWS WAF is pretty low cost. You can expect to pay less than $10 / month and still get an ok amount of value on a decently popular site. The problem is you have to manually configure a lot, the rate limiting aspect is way worse than Cloudflare and while the AWS WAF can geolocate an IP address and block by country it does not send the country code back to you in a header where as Cloudflare does. The last one stings because it's super handy to have an accurate country code attached to each request, especially if it's something you don't need to think about or waste I/O time calling out to a 3rd party service in the background to backfill in that data later.
- emmanueloga_ 3y ago
  This is helpful! I found some CDK libraries that allows for connecting a load balancer or Cloudfront to WAF with a few lines of code. I'll give it a try! [1] [2]. -- 1: https://github.com/awslabs/aws-solutions-constructs/tree/main/source/patterns/%40aws-solutions-constructs/aws-wafwebacl-cloudfront#overview https://github.com/awslabs/aws-solutions-constructs/tree/mai... 2: https://constructs.dev/search?q=waf&cdk=aws-cdk&cdkver=2&langs=typescript&sort=downloadsDesc&offset=0 https://constructs.dev/search?q=waf&cdk=aws-cdk&cdkver=2&lan...
  - nickjj 3y ago
    Yep, that's one of the values of the WAF, it can be associated with your ALB which means you can match rules on headers, cookies, etc. after the traffic has been decrypted.

rfmoz 3y ago

With Fastly WAF - SignalSciences, Distil Networks - Imperva, Akamai - StackPath. There are a few companies that started alone in this ecosystem and found the evolution path with the mayor CDN networks, those who have failed themselves in provide a good internal alternative service. Human security - PerimeterX, Haproxy WAF, Datadome, are other players to different target audience. If you have a good control over the app exposed, maybe you only need a WAF in the sense of stop stuff outside your infra. The sql injections, weird urls trying the way to /etc/passwd or related things look from the past and only makes noise nowadays. The real issue is when someone hits you in a rate impossible to manage with your resources or when it cost you more than the securing layer.

nickjj 3y ago

If you're on AWS the AWS WAF is pretty low cost. You can expect to pay less than $10 / month and still get an ok amount of value on a decently popular site. The problem is you have to manually configure a lot, the rate limiting aspect is way worse than Cloudflare and while the AWS WAF can geolocate an IP address and block by country it does not send the country code back to you in a header where as Cloudflare does. The last one stings because it's super handy to have an accurate country code attached to each request, especially if it's something you don't need to think about or waste I/O time calling out to a 3rd party service in the background to backfill in that data later.

emmanueloga_ 3y ago
This is helpful! I found some CDK libraries that allows for connecting a load balancer or Cloudfront to WAF with a few lines of code. I'll give it a try! [1] [2]. -- 1: https://github.com/awslabs/aws-solutions-constructs/tree/main/source/patterns/%40aws-solutions-constructs/aws-wafwebacl-cloudfront#overview https://github.com/awslabs/aws-solutions-constructs/tree/mai... 2: https://constructs.dev/search?q=waf&cdk=aws-cdk&cdkver=2&langs=typescript&sort=downloadsDesc&offset=0 https://constructs.dev/search?q=waf&cdk=aws-cdk&cdkver=2&lan...
- nickjj 3y ago
  Yep, that's one of the values of the WAF, it can be associated with your ALB which means you can match rules on headers, cookies, etc. after the traffic has been decrypted.