Enable Logging for Web Access Control Lists

01 Sign in to the AWS Management Console.

02 Navigate to Amazon WAF console at https://console.aws.amazon.com/wafv2/.

03 In the left navigation panel, under AWS WAF section, choose Web ACLs. A Web ACL is a collection of firewall rules that allow you to take control over the web requests that your AWS resources respond to.

04 Click on the name of the Web ACL that you want to examine, available in the Name column.

05 Select the Logging and metrics tab and check the Logging configuration status available in the Logging section. If the Logging status is set to Disabled, the Logging feature is not enabled for the selected Amazon WAF Web Access Control List (Web ACL).

06 Repeat steps no. 4 and 5 for each Web ACL created within your AWS cloud account.

01 Run list-web-acls command (OSX/Linux/UNIX) to describe the Amazon Resource Name (ARN) of each Web ACL created in your AWS cloud account. Use the --scope command parameter to describe the available Web ACLs based on the type of the associated resource (CLOUDFRONT for Amazon CloudFront distributions and REGIONAL for regional resources such as Application Load Balancers, API Gateway APIs, and AWS AppSync APIs):

aws wafv2 list-web-acls
  --scope REGIONAL
  --query 'WebACLs[*].ARN'

02 The command output should return the requested Amazon Resource Names (ARNs):

[
  "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/cc-malicious-viewers-web-acl/abcdabcd-1234-abcd-1234-abcd1234abcd",
  "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/cc-asp-bot-protection-web-acl/abcd1234-abcd-1234-abcd-1234abcd1234"
]

03 Run get-logging-configuration command (OSX/Linux/UNIX) using the ARN of the Web ACL that you want to examine as the identifier parameter and custom query filters to describe the Logging feature configuration for the specified web ACL:

aws wafv2 get-logging-configuration
  --resource-arn arn:aws:wafv2:us-east-1:123456789012:regional/webacl/cc-malicious-viewers-web-acl/abcdabcd-1234-abcd-1234-abcd1234abcd
  --query 'LoggingConfiguration'

04 The command output should return the configuration metadata for the requested feature:

An error occurred (WAFNonexistentItemException) when calling the GetLoggingConfiguration operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist.

05 Repeat steps no. 3 and 4 for each Web ACL available within your AWS cloud account.

01 Sign in to the AWS Management Console.

02 Before you can enable logging for your Web ACLs, you need to create a delivery stream in Amazon Kinesis Firehose whose name starts with "aws-waf-logs-". To get started, navigate to Amazon Kinesis Firehose console at https://console.aws.amazon.com/kinesis/.

03 In the navigation panel, choose Data Firehose, and select Create delivery stream.

04 On the Kinesis Data Firehose - Create delivery stream setup page, perform the following actions:

1. Enter a unique name for your new delivery stream that starts with aws-waf-logs- and choose Direct PUT or other sources for the Source.
2. For Destination, choose Amazon S3 and select the name of the destination bucket from the S3 bucket dropdown list.
3. Configure the rest of the available options based on your application requirements, then choose Create delivery stream to create your new Amazon Kinesis Firehose delivery stream.

05 Navigate to Amazon WAF console at https://console.aws.amazon.com/wafv2/.

06 In the left navigation panel, under AWS WAF section, choose Web ACLs.

07 Click on the name of the Web ACL that you want to reconfigure, available in the Name column.

08 Select the Logging and metrics tab and choose Enable logging within the Logging section.

09 On the Enable logging configuration page, perform the following actions:

1. Under Amazon Kinesis Data Firehose Delivery Stream, choose Select a delivery stream, and choose the delivery stream created at the previous steps.
2. (Optional) Under Redacted fields, select the data fields that you want to hide from the logs.
3. Choose Enable logging to apply the changes. This will enable logging for the selected Amazon WAF Web Access Control List (Web ACL). When you enable logging, Amazon WAF creates a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose delivery stream.

10 Repeat steps no. 7 – 9 for each Web ACL created within your AWS cloud account.

01 Before you can enable logging for your Web ACLs, you need to create a delivery stream in Amazon Kinesis Firehose whose name starts with "aws-waf-logs-". To create the required Amazon Kinesis Data Firehose delivery stream execute create-delivery-stream command (OSX/Linux/UNIX). You can use Amazon S3 as destination for the logging data, as shown in the example below:

aws firehose create-delivery-stream
  --region us-east-1
  --delivery-stream-name aws-waf-logs-web-acl-logging
  --delivery-stream-type DirectPut
  --extended-s3-destination-configuration '{"RoleARN":"arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-aws-waf-logs--us-east-1-1612184128082", "BucketARN": "arn:aws:s3:::cc-eb-environment-logs-bucket"}'

02 The command output should return the ARN of the newly created delivery stream:

{
  "DeliveryStreamARN": "arn:aws:firehose:us-east-1:123456789012:deliverystream/aws-waf-logs-web-acl-logging"
}

03 Run put-logging-configuration command (OSX/Linux/UNIX) to enable logging for the specified Amazon WAF Web Access Control List (Web ACL) using the Kinesis Data Firehose delivery stream created at the previous steps:

aws wafv2 put-logging-configuration
  --region us-east-1
  --logging-configuration ResourceArn=arn:aws:wafv2:us-east-1:123456789012:regional/webacl/cc-malicious-viewers-web-acl/abcdabcd-1234-abcd-1234-abcd1234abcd,LogDestinationConfigs=arn:aws:firehose:us-east-1:123456789012:deliverystream/aws-waf-logs-web-acl-logging

04 The command output should return the logging configuration for the modified Web ACL:

{
  "LoggingConfiguration": {
    "ResourceArn":
    "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/cc-malicious-viewers-web-acl/abcdabcd-1234-abcd-1234-abcd1234abcd",
    "LogDestinationConfigs": [
      "arn:aws:firehose:us-east-1:123456789012:deliverystream/aws-waf-logs-web-acl-logging"
    ],
    "ManagedByFirewallManager": false
  }
}

05 Repeat steps no. 3 and 4 for each Web ACL available within your AWS cloud account.