Configure a Service Firewall

The Firewall (WAF) section adds AWS WAF protection to a supported service environment. You can use StationOps-managed rules, reference an existing web ACL, and scope selected rules to paths, IP sets, or JA4 fingerprint sets.

The firewall controls are not available for every target. For example, runner and static targets and sidecar services do not expose this configuration.

---

Open the Firewall Configuration

1. Open the project in Architect.
2. Create or edit a supported service.
3. Select the environment you want to configure.
4. Expand Firewall (WAF).
5. Add rules, or enter the ID of an existing web ACL when reusing one.
6. Save and deploy the infrastructure configuration.

Firewall rules are configured per environment. Path groups are defined on the service and are shared by its environment panels.

---

Choose Rules

StationOps offers the following rule types:

• Block refuses every request matched by its scope. With no scope, it blocks the entire service.
• Rate limit acts when an address exceeds a request count during a 60, 120, 300, or 600 second window. The action can block or challenge the caller.
• Token gate challenges matching requests so only clients with a valid AWS WAF token pass.
• Common rule set applies a broad AWS-managed baseline for common web risks.
• Block known bad inputs detects request patterns such as invalid host headers or path traversal.
• Block known bad IPs uses the Amazon threat-reputation list.
• Block anonymous IPs covers sources such as VPNs, proxies, Tor exit nodes, and hosting providers.
• Custom rule runs an AWS WAF rule group you own, referenced by its full ARN.
• Bot Control enables AWS Bot Control at the common inspection level and incurs AWS charges.
• DDoS protection adds the AWS anti-DDoS managed rule group and incurs AWS charges.

Select Add Recommended Rules to add the free managed baseline groups for known bad IPs, known bad inputs, common rules, and anonymous IPs.

---

Scope a Rule

An empty scope matches every request. Add criteria to narrow a rule to one or more of these resources:

• Path group for related URL paths.
• IP set for a maintained list of network addresses.
• JA4 set for selected TLS-client fingerprints.

Multiple criteria of the same kind widen the match, while different kinds narrow it. For example, two path groups match either group; a path group combined with an IP set requires both conditions.

Token gates and challenge actions are designed for browser traffic. Fetch or XHR requests need the AWS WAF application integration SDK to supply a token, so exclude incompatible API paths from the path group.

---

Test With Count Only

Enable Count only on a new or changed rule to record what it would match without enforcing the rule's normal action. Review the resulting AWS WAF metrics and logs, refine the scope, and then turn count-only mode off when the behavior is correct.

For a custom rule group, count-only mode overrides the actions from the whole referenced group.

---

Related Guide