The slide I presented at AWS User Group Jakarta x Pop-up Loft 2019 (https://www.meetup.com/AWS-User-Group-Indonesia/events/264306777/)

1. Do you use any of these?
● API Gateway
● Application Load Balancer
● CloudFront

2. Securing your Public API with AWS WAF
Rafi Kurnia Putra
Cloud Infrastructure Engineer
Traveloka
AWS User Group Jakarta x Pop-up Loft - 22/10/2019 - WeWork, Noble House Kuningan Lv.30

3. In the last 7 days, we blocked...
● Over millions of DoS attacks.
● Thousands of WAF attacks.

4. Our Problems
● Centralized WAF management.
● Hard to attribute WAF costs.
● Have large number of public endpoints that:
○ Keep growing.
○ Hosted in multiple AWS Accounts.
○ Owned and maintained by various teams.

5. What did we do?

6. What is AWS WAF?
● Designed to helps protect your app from common attacks.
● Controls which traffic to allow or block to your app.
● Allows user to create custom rules.

7. Example: AWS WAF on ALB

8. Example: AWS WAF on ALB

9. Why AWS WAF
● Well integrated with other AWS Services.
● Access control based on AWS IAM.
● Covers common needs.
● Inexpensive.
● Decentralized.
● Cost attribution.
● Easy to set up WAF rules.

10. AWS WAF Limitations
● Very hard to analyze the WAF logs.
● It is difficult to trace the logs from a single request.
● Getting a dashboard for monitoring requires more setup.
● Can’t parse and validate JSON & XML payload

11. Bonus: Terraform Modules
1. https://github.com/traveloka/terraform-aws-waf-owasp-top-10-rules

12. Bonus: Terraform Modules
2. https://github.com/traveloka/terraform-aws-waf-webacl-supporting-resources

13. Thank you!
rafi(dot)kurnia(dot)putra[at]gmail(dot)com for any enquiries!

14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Notes:
Startups previously issued AWS Promotional Credit may not be eligible to receive additional credit.
Promotional credits will be a one-time offer
Exact credit eligibility amount varies by the organization through which you apply.
Redeem $1,000 worth of credits:
1. Create a free AWS account here:
https://portal.aws.amazon.com/billing/signup#/
2. Navigate to this link: https://aws.amazon.com/activate/portfolio-signup/
3. Signup using 0aKL8 as your Organization ID
The credits will be in your account upon validation after 1~2 weeks
Learn more here : https://aws.amazon.com/activate/portfolio-detail/
AWS ACTIVATE
AWS Activate Program provides startups with the resources they need to quickly get
started on AWS – including credits, training, and support. Scaling to a unicorn begins
with AWS Activate.

15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
INDONESIA’S
STARTUPS
RUN ON AWS
Services Used:
EC2, RDS, S3
“We found that the cost of
an on-premises
infrastructure was too high,
so we turned to the cloud.”
Sofian Hadiwijaya
CTO
“Before AWS, 20–30 percent of our time would
be spent ensuring that servers are responsive.
By using AWS, we simply deploy and maybe
monitor for an hour and that’s it.
Abhilash Ramakrishna
CTO
Services Used:
EC2, RDS, S3
AWS ACTIVATE
Check us out at
https://aws.amazon.com/events/a
sean-startup/
“AWS gave us better access to cost-effective
open-source software that allowed us to drive
innovation”
- Lodewijk Tanamal
CTO
Services Used:
EC2, Kinesis, Quicksight, Lambda
Or scan here!
https://twitter.com/awsstartups/
And many other…

16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved
FEEDBACKS!
Scan the QR stickers on your table and complete the feedback form to redeem an
EXCLUSIVE SWAG!
Simply show your completed survey to the Loft manager ☺

17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved
HAVE FUN!
Get your polaroid pictures taken, hang them up on the wall and write us a note!