ELB WAF Disabled

Risk Level: Low

Description: 

This plugin ensures that WAF is activated on all Application Load Balancers. Enabling WAF gives you more control over requests to the load balancer, permitting or disallowing traffic based on Web ACL rules.

About the Service :

The Amazon ECS service may be configured to employ Elastic Load Balancing to uniformly distribute traffic among your service's jobs. The transport layer (TCP/SSL) or the application layer (HTTP/HTTPS) are where a Classic Load Balancer makes routing choices. A fixed relationship between the load balancer port and the container instance port is presently required by traditional load balancers.

Impact : 

Enabling WAF gives you more control over requests to the load balancer, permitting or disallowing traffic based on Web ACL rules.

Steps to reproduce :

1. Login to your AWS Management Console.
   
2. Navigate to the EC2 console.
   https://ap-south-1.console.aws.amazon.com/ec2/ 
   
3. Click on Load Balancers under Load Balancing.
   
4. Select the load balancer that you want to examine.
   
5. In the Description tab, check if WAF fail open is enabled or not. 
   
6. Since it is not enabled hence we can conclude that the best security practices are not followed.
7. Repeat steps for other EC2 load balancers as well. 

Steps for remediation :

1. Login to your AWS Management Console.
   
2. Navigate to the EC2 console.
   https://ap-south-1.console.aws.amazon.com/ec2/ 
   
3. Click on Load Balancers under Load Balancing.
   
4. Select the load balancer that you want to examine.
   
5. In the Description tab, check if WAF fail open is enabled or not. 
   
6. Since it is not enabled hence we can conclude that the best security practices are not followed.
7. Click on Edit and enable WAF and then click on Save to save changes.
   
8. Repeat steps for other EC2 load balancers as well. 

References:

• https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/