View a markdown version of this page

Understand distribution security controls in Amazon Lightsail - Amazon Lightsail
DDoS protectionWeb Application Firewall (WAF)Topics

Understand distribution security controls in Amazon Lightsail

Security controls help protect your website or web application from distributed denial of service (DDoS) attacks, common web threats, and security vulnerabilities. You can view and manage the security controls for your distribution on the Security tab on your distribution's management page.

DDoS protection

A DDoS attack can prevent legitimate users from accessing your website or web application by overwhelming it with traffic. DDoS protection detects and automatically mitigates these attacks. DDoS protection is always enabled for your distribution, on all distribution plans, at no extra cost. For more information, see DDoS protection.

Web Application Firewall (WAF)

The Web Application Firewall (WAF) uses WAF rule groups to help protect your website or web application from common web threats and security vulnerabilities. WAF is supported on the USD $10/month and USD $35/month distribution plans. For more information, see Web Application Firewall (WAF) by distribution plan.

Each WAF rule group contains multiple rules that inspect requests for a specific type of threat. There are two types of WAF rule groups:

  • Managed WAF rule groups: Predefined WAF rule groups that protect against common categories of web threats. You enable or disable them without configuring any settings.

  • Custom WAF rule groups: Advanced, specialized WAF rule groups that protect against account takeover, fraudulent account creation, and malicious bots. These rule groups require specific configuration before you can enable them.

By default, all WAF rule groups are disabled. To enable them, see Enable WAF for your distribution.

Managed WAF rule groups

The following managed WAF rule groups are available:

  • Core rule set - Provides protection against exploitation of a wide range of vulnerabilities, including some of the high-risk and commonly occurring vulnerabilities described in OWASP publications, such as the OWASP Top 10. For more information, see Core rule set (CRS) managed rule group.

    Warning

    This rule group can block file uploads or form submissions larger than 8 KB.

  • Known bad inputs - Blocks request patterns that are known to be invalid and associated with the exploitation or discovery of vulnerabilities. This rule group is ideal if you want to reduce the risk of a malicious actor discovering a vulnerable website or web application. For more information, see Known bad inputs managed rule group.

  • Anonymous IP list - Blocks requests from services that permit the obfuscation of viewer identity, such as VPNs, proxies, Tor nodes, and web hosting providers. This rule group is ideal if you want to filter out viewers who might be trying to hide their identity. For more information, see Anonymous IP list managed rule group.

  • Admin protection - Blocks external access to exposed administrative pages, which can help reduce the risk of a malicious actor gaining administrative access to your website or web application. For more information, see Admin protection managed rule group.

    Warning

    After you enable this rule group, access administrative pages, such as /wp-admin, directly from your origin instead of through your distribution.

  • SQL database - Blocks request patterns associated with the exploitation of SQL databases, such as SQL injection attacks. This rule group is ideal if your website or web application interfaces with an SQL database. For more information, see SQL database managed rule group.

  • Linux operating system - Blocks request patterns associated with the exploitation of vulnerabilities specific to Linux, including Linux-specific Local File Inclusion (LFI) attacks. This rule group is ideal if any part of your website or web application runs on Linux. Use it together with the POSIX operating system rule group. For more information, see Linux operating system managed rule group.

  • POSIX operating system - Blocks request patterns associated with the exploitation of vulnerabilities specific to POSIX and POSIX-like operating systems, including LFI attacks. This rule group is ideal if any part of your website or web application runs on Linux or another POSIX-like operating system, such as FreeBSD. For more information, see POSIX operating system managed rule group.

  • Windows operating system - Blocks request patterns associated with the exploitation of vulnerabilities specific to Windows, such as the remote execution of PowerShell commands. This rule group is ideal if any part of your website or web application runs on Windows. For more information, see Windows operating system managed rule group.

  • PHP application - Blocks request patterns associated with the exploitation of vulnerabilities specific to the use of the PHP programming language, including the injection of unsafe PHP functions. This rule group is ideal if PHP is installed on any server that your website or web application uses. For more information, see PHP application managed rule group.

  • WordPress application - Blocks request patterns associated with the exploitation of vulnerabilities specific to WordPress sites. This rule group is ideal if your website runs on WordPress. Use it together with the SQL database and PHP application rule groups. For more information, see WordPress application managed rule group.

  • Amazon IP reputation list - Blocks requests based on Amazon internal threat intelligence. This rule group is ideal if you want to block IP addresses typically associated with bots or other threats. For more information, see Amazon IP reputation list managed rule group.

Custom WAF rule groups

Note

Custom WAF rule groups are supported only on the USD $35/month distribution plan. For more information, see Web Application Firewall (WAF) by distribution plan.

The following custom WAF rule groups are available:

  • Account takeover prevention - Provides protection against malicious account takeover attempts by inspecting login requests to your login page. It checks login credentials against a database of stolen credentials and blocks clients that send too many suspicious login requests. This rule group is ideal if your website or web application has a login page. It requires that you choose the Request body type (JSON or Form encoded) and provide the Login path, Username field, and Password field. For more information, see Account takeover prevention (ATP) rule group.

  • Account creation fraud prevention - Provides protection against fraudulent account creation attempts on your website or web application. It detects bulk account creation attempts and blocks new accounts that use compromised credentials. This rule group is ideal if your website or web application lets visitors create accounts. It requires that you choose the Request body type (JSON or Form encoded) and provide the Account creation path and Registration page path. For more information, see Account creation fraud prevention (ACFP) rule group.

  • Bot control - Provides protection against automated bots that can consume excess resources, skew business metrics, cause downtime, or perform malicious activities. This rule group is ideal if you want to manage bot traffic to your website or web application. It requires that you choose an inspection level. Choose Common to detect self-identifying bots, such as web scrapers, search engines, and automated browsers. Choose Targeted to also detect sophisticated bots. The Targeted level can show challenges or CAPTCHA puzzles to your visitors. For more information, see Bot Control rule group.

Topics