AWS waf documentation change
Summary
Updated migration steps for AWS WAF Classic to v2, added cleanup script references, bulk migration script, Firewall Manager migration guidance, and security review recommendation.
Security assessment
The changes emphasize identifying unused web ACLs via cleanup scripts and reviewing migrated configurations for security requirements. While these are security best practices, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/waf/latest/developerguide/waf-migrating-how-it-works.md b/waf/latest/developerguide/waf-migrating-how-it-works.md index 8a7e73acc..a91869d0c 100644 --- a//waf/latest/developerguide/waf-migrating-how-it-works.md +++ b//waf/latest/developerguide/waf-migrating-how-it-works.md @@ -11 +11 @@ You can now use the updated experience to access AWS WAF functionality anywhere -The automated migration carries over most of your AWS WAF Classic protection pack (web ACL) configuration, leaving some things that you need to handle manually. +You can migrate your web ACLs from AWS WAF Classic to AWS WAF v2 using several methods. Follow these steps to complete your migration. @@ -13 +13 @@ The automated migration carries over most of your AWS WAF Classic protection pac -###### Note +###### To migrate from AWS WAF Classic to AWS WAF v2 @@ -15 +15 @@ The automated migration carries over most of your AWS WAF Classic protection pac -Some protection configurations cannot be automatically migrated, and require manual configuration in AWS WAF (v2). See the list at [Migration caveats and limitations](./waf-migrating-caveats.html). + 1. Identify your AWS WAF Classic web ACLs: @@ -17 +17 @@ Some protection configurations cannot be automatically migrated, and require man -The following lists the high-level steps for migrating a protection pack (web ACL). + * View a list of your web ACLs in the AWS Health dashboard. @@ -19 +19 @@ The following lists the high-level steps for migrating a protection pack (web AC - 1. The automated migration reads everything related to your existing protection pack (web ACL), without modifying or deleting anything in AWS WAF Classic. It creates a representation of the web ACL and its related resources, compatible with AWS WAF. It generates an AWS CloudFormation template for the new protection pack (web ACL) and stores it in an Amazon S3 bucket. + * Use the [AWS WAF Classic web ACL cleanup script]( https://github.com/aws-samples/sample-for-waf-classic-to-wafv2-migrate-and-cleanup/tree/main/scripts/waf-classic-cleanup ) to get a list of all your web ACLs and their associations. This helps you identify which web ACLs are actively protecting resources and allows you to delete unused web ACLs. @@ -21 +21 @@ The following lists the high-level steps for migrating a protection pack (web AC - 2. You deploy the template into AWS CloudFormation, in order to recreate the protection pack (web ACL) and related resources in AWS WAF. + 2. Migrate individual web ACLs: @@ -23 +23 @@ The following lists the high-level steps for migrating a protection pack (web AC - 3. You review the protection pack (web ACL), and manually complete the migration, making sure that your new protection pack (web ACL) takes full advantage of the capabilities of the latest AWS WAF. + * Follow the migration process in the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/waf-migrating-procedure.html). @@ -25 +25 @@ The following lists the high-level steps for migrating a protection pack (web AC - 4. You manually switch your protected resources over to the new protection pack (web ACL). + * Use the migration wizard to parse your AWS WAF Classic web ACL and generate an AWS CloudFormation template. @@ -26,0 +27 @@ The following lists the high-level steps for migrating a protection pack (web AC + * Use the generated template to create an equivalent AWS WAF v2 web ACL and complete the migration. @@ -27,0 +29 @@ The following lists the high-level steps for migrating a protection pack (web AC + 3. For multiple eligible web ACLs: @@ -28,0 +31,14 @@ The following lists the high-level steps for migrating a protection pack (web AC + * Use the [AWS WAF bulk migration script](https://github.com/aws-samples/sample-for-waf-classic-to-wafv2-migrate-and-cleanup/tree/main/scripts/waf-classic-migration ) to migrate multiple eligible AWS WAF Classic web ACLs simultaneously. + + 4. For web ACLs managed by AWS Firewall Manager: + + * Firewall Manager policies use AWS WAF Classic web ACLs with AWS WAF Classic policies. For Shield Advanced policies created before January 2022, Firewall Manager also uses AWS WAF Classic web ACLs. You must migrate these policies to use AWS WAF v2 web ACLs. + +Follow the instructions at [Migrating AWS WAF Classic Web ACLs in Firewall Manager](./migrate-waf-classic-fms.html). + + + + +###### Important + +We recommend reviewing each migrated web ACLto ensure it meets your security requirements before associating it with your resources.