Wallarm Connector for Amazon CloudFront¶

If Wallarm is configured to block malicious activity:

To deploy a Wallarm-hosted node for the connector, follow the instructions.

Choose an artifact for a self-hosted node deployment and follow the attached instructions:

• All-in-one installer for Linux infrastructures on bare metal or VMs
• Docker image for environments that use containerized deployments
• Helm chart for infrastructures utilizing Kubernetes

1. Proceed to Wallarm Console → Security Edge → Connectors → Download code bundle and download a code bundle for your platform.

   If running a self-hosted node, contact sales@wallarm.com to get the code bundle.

2. Proceed to your AWS Console → Services → Lambda → Functions.

3. Select the us-east-1 (N. Virginia) region which is required for Lambda@Edge functions.

4. Create function with the following settings:

   • Runtime: Python 3.x.
   • Execution role: Create a new role from AWS policy templates → Basic Lambda@Edge permissions (for CloudFront trigger).
   • Other settings can remain as default.

5. Once the function is created, on the Code tab, paste the Wallarm request processing code.

6. Update the following parameters in the code:

   • wlrm_node_addr: your Wallarm node instance address.
   • wlrm_inline: if using out-of-band mode, set to False.
   • If necessary, modify other parameters.

7. Proceed to Actions → Deploy to Lambda@Edge and specify the following settings:

   • Configure new CloudFront trigger.
   • Distribution: your CDN that routes traffic to the origin you want to protect.
   • Cache behavior: the cache behavior for the Lambda function, typically *.

   • CloudFront event:

     • Origin request: executes the function only when CloudFront CDN requests data from the backend. If CDN returns a cached response, the function will not be executed.
     • Viewer request: executes the function for every request to CloudFront CDN.

   • Check Include body.

   • Check Confirm deploy to Lambda@Edge.

   

8. Repeat the procedure for the Wallarm-provided response function, selecting responses as the trigger.

   Ensure the response trigger matches the request trigger (origin response for origin request, viewer response for viewer request).

You can deploy both functions directly from the AWS Serverless Application Repository (SAR). The functions will be deployed in the us-east-1 (N. Virginia) region which is required for Lambda@Edge functions.

1. Go to Wallarm policies on AWS Serverless Application Repository → Deploy.
2. Leave the deployment settings as default.

3. After the deployment is complete, go to the created IAM roles → Trust relationships, and update both roles (one for requests and one for responses) with the following policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "edgelambda.amazonaws.com",
                       "lambda.amazonaws.com"
                   ]
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   

4. Proceed to your AWS Console → Services → Lambda → Functions.

5. Open the serverlessrepo-wallarm-connector-RequestHandler-xxx function.

6. On the Code tab, update the following parameters:

   • wlrm_node_addr: your Wallarm node instance address.
   • wlrm_inline: if using out-of-band mode, set to False.
   • If necessary, modify other parameters.

7. Proceed to Actions → Deploy to Lambda@Edge and specify the following settings:

   • Configure new CloudFront trigger.
   • Distribution: your CDN that routes traffic to the origin you want to protect.
   • Cache behavior: the cache behavior for the Lambda function, typically *.

   • CloudFront event:

     • Origin request: executes the function only when CloudFront CDN requests data from the backend. If CDN returns a cached response, the function will not be executed.
     • Viewer request: executes the function for every request to CloudFront CDN.

   • Check Include body.

   • Check Confirm deploy to Lambda@Edge.

   

8. Return to your AWS Console → Services → Lambda → Functions.

9. Open the serverlessrepo-wallarm-connector-ResponseHandler-xxx function.

10. Repeat the procedure for the Wallarm-provided response function, selecting responses as the trigger.

    Ensure the response trigger matches the request trigger (origin response for origin request, viewer response for viewer request).

1. Proceed to Wallarm Console → Security Edge → Connectors → Download code bundle and download the updated Wallarm Lambda@Edge functions.

   If running a self-hosted node, contact sales@wallarm.com to get the updated code bundle.

2. Replace the code in your deployed Lambda@Edge functions with the updated bundle.

   Preserve the existing values for parameters like wlrm_node_addr, wlrm_inline, and others.

   Keep the existing function triggers unchanged.

3. Deploy the updated functions.

1. Repeat the steps outlined in the 2^nd step using the new version of the functions.
2. After linking the updated functions to your distributions, remove the previous versions of the functions from the CloudFront triggers to avoid conflicts.