AWS WAF Security Implementation with OWASP Juice Shop
OWASP Juice Shop behind AWS WAF, taken from a 30% attack-suite block rate to 100% by fixing a managed-rule override bug, with Kinesis-to-Athena log analytics and a sub-30-second emergency block script.
First pass through the OWASP attack suite against a freshly-provisioned WAF blocked only 3 of 10 negative test cases: path traversal, command injection, and oversized headers all sailed through. The rules were attached and enabled, they just weren't doing anything, because the managed rule group override was set in a way that neutralized the vendor's own Block actions.
Root cause was override_action treatment on managed rule groups: setting it explicitly counted as an override that stripped the vendor block. Fixing that plus running new rules in Count first for tuning then flipping to Block took the negative pass rate from 30% to 100%. Around that: Kinesis Firehose ships WAF logs to S3, Athena queries the last 24 hours for top attack vectors, a Python script pushes emergency IP blocks with a dry-run mode, and GitHub Actions runs tfsec and Checkov on every change to terraform/.
A WAF that looks right in the console still needs to be attacked before you trust it.
Every WAF change now ships with a passing attack suite as evidence, and the emergency block path deploys a new IP or CIDR rule in under 30 seconds from the CLI.
- 10-case OWASP attack suite went from 30% to 100% blocked after tuning
- Kinesis Firehose to S3 to Athena for near real time WAF log queries
- Sub-30-second emergency IP or CIDR block script with dry-run mode