Know-How
WAF konfigurace — Web Application Firewall
WAF blokuje SQL injection, XSS, bot traffic na aplikační vrstvě. Defense-in-depth vrstva.
ModSecurity + OWASP CRS
# Nginx
modsecurity on;
modsecurity_rules_file /etc/modsecurity/crs/crs-setup.conf;
modsecurity_rules_file /etc/modsecurity/crs/rules/*.conf;
AWS WAF
resource "aws_wafv2_web_acl" "main" {
default_action { allow {} }
rule {
name = "aws-managed"
statement {
managed_rule_group_statement {
vendor_name = "AWS"
name = "AWSManagedRulesCommonRuleSet"
}
}
}
}
Klíčový takeaway
WAF je defense-in-depth, ne náhrada za bezpečný kód. Začněte s managed rules.