ACFP 範例:對遭到入侵認證的自訂回應 - AWS WAF、AWS Firewall Manager 與 AWS Shield Advanced

本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。

ACFP 範例:對遭到入侵認證的自訂回應

根據預設,規則群組執行的認證檢查會透過標記要求並封鎖要求來AWSManagedRulesACFPRuleSet處理遭到入侵的認證。如需有關規則群組和規則行為的詳細資訊,請參閱AWS WAF欺詐控制帳戶創建欺詐預防(ACFP)規則組

要通知用戶他們提供的帳戶憑據已被洩露,您可以執行以下操作:

  • SignalCredentialCompromised規則覆寫為 Count — 這會導致規則僅計算相符請求並加上標籤。

  • 使用自訂處理新增標籤比對規則 — 設定此規則以符合 ACFP 標籤並執行您的自訂處理。

下列 Web ACL 清單顯示先前範例中的 ACFP 管理規則群組,而SignalCredentialCompromised規則動作會覆寫為計數。使用此配置時,當此規則組評估任何使用受損憑據的 Web 請求時,它將標記該請求,但不會阻止它。

此外,Web ACL 現在具有名為的自訂回應aws-waf-credential-compromised和名為的新規則AccountSignupCompromisedCredentialsHandling。規則優先順序的數值設定高於規則群組,因此它會在 Web ACL 評估中的規則群組之後執行。新規則會符合具有規則群組遭入侵認證標籤的任何要求。當規則找到相符項目時,會將Block動作套用至具有自訂回應主體的要求。自訂回應本文會向使用者提供其認證已遭入侵的資訊,並提出要採取的動作。

{ "Name": "compromisedCreds", "Id": "... ", "ARN": "arn:aws:wafv2:us-east-1:111122223333:regional/webacl/compromisedCreds/...", "DefaultAction": { "Allow": {} }, "Description": "", "Rules": [ { "Name": "AWS-AWSManagedRulesACFPRuleSet", "Priority": 0, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesACFPRuleSet", "ManagedRuleGroupConfigs": [ { "AWSManagedRulesACFPRuleSet": { "CreationPath": "/web/signup/submit-registration", "RegistrationPagePath": "/web/signup/registration", "RequestInspection": { "PayloadType": "JSON", "UsernameField": { "Identifier": "/form/username" }, "PasswordField": { "Identifier": "/form/password" }, "EmailField": { "Identifier": "/form/email" }, "PhoneNumberFields": [ { "Identifier": "/form/country-code" }, { "Identifier": "/form/region-code" }, { "Identifier": "/form/phonenumber" } ], "AddressFields": [ { "Identifier": "/form/name" }, { "Identifier": "/form/street-address" }, { "Identifier": "/form/city" }, { "Identifier": "/form/state" }, { "Identifier": "/form/zipcode" } ] }, "EnableRegexInPath": false } } ], "RuleActionOverrides": [ { "Name": "SignalCredentialCompromised", "ActionToUse": { "Count": {} } } ] } }, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AWS-AWSManagedRulesACFPRuleSet" } }, { "Name": "AccountSignupCompromisedCredentialsHandling", "Priority": 1, "Statement": { "LabelMatchStatement": { "Scope": "LABEL", "Key": "awswaf:managed:aws:acfp:signal:credential_compromised" } }, "Action": { "Block": { "CustomResponse": { "ResponseCode": 406, "CustomResponseBodyKey": "aws-waf-credential-compromised", "ResponseHeaders": [ { "Name": "aws-waf-credential-compromised", "Value": "true" } ] } } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AccountSignupCompromisedCredentialsHandling" } } ], "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "compromisedCreds" }, "Capacity": 51, "ManagedByFirewallManager": false, "LabelNamespace": "awswaf:111122223333:webacl:compromisedCreds:", "CustomResponseBodies": { "aws-waf-credential-compromised": { "ContentType": "APPLICATION_JSON", "Content": "{\n \"credentials-compromised\": \"The credentials you provided have been found in a compromised credentials database.\\n\\nTry again with a different username, password pair.\"\n}" } } }