Solutions

Bloon implemented a comprehensive security strategy using AWS CloudFront:

• 01. Implementation of Origin Security Features
  
  1.1 Origin Access Identity (OAI) for S3
  
  • Bloon configured an Origin Access Identity (OAI) and associated it with the CloudFront distribution to restrict direct access to the S3 bucket containing static content.
  • A bucket policy was implemented to allow access only to requests originating from CloudFront, enforced through the OAI.
  1.2 Security Groups and NACLs for EC2
  
  • Security groups were configured for EC2 instances hosting dynamic content, permitting inbound traffic solely from CloudFront IP ranges and blocking direct access.
  • Network ACLs were utilized at the subnet level to impose additional security controls and restrict unauthorized access.
  
  
  1.3 Custom Headers for Origin Validation
  • CloudFront was configured to include a custom header (X-Origin-Auth) with each request to the origin.
  • Bloon's application server validates the presence and value of the X-Origin-Auth header to ensure requests originate from CloudFront, enhancing origin validation.
• 02. Implementation of Application Firewalls @Edge using AWS WAF
  
  2.1. AWS WAF Configuration
  
  • Bloon created a Web Application Firewall (WAF) ACL and associated it with CloudFront to filter incoming requests.
  • AWS Managed Rules were enabled to protect against common threats such as SQL injection and XSS, providing immediate security against known vulnerabilities.
  2.2 Custom Rules
  
  • Custom rules were established to implement rate limiting, restricting the number of requests from a single IP address to mitigate DDoS attacks.
  • Geo-blocking was employed to block requests from specific countries known for malicious activity, reducing the risk of potential attacks.
  2.3. Logging and Monitoring
  
  • Bloon enabled logging for the Web ACL, directing logs to an S3 bucket for analysis and auditing.
  • CloudWatch alarms were configured using WAF metrics to alert administrators of anomalous activity, such as spikes in blocked requests, facilitating prompt response to potential threats.