AWS elasticloadbalancing high security documentation change
Summary
Added new 'WAF HTTP/2 traffic inspection behavior' section with configuration options
Security assessment
Documents security feature to prevent HTTP/2 frame-splitting attacks; explicitly addresses security bypass techniques and provides mitigation controls
Diff
diff --git a/elasticloadbalancing/latest/application/edit-target-group-attributes.md b/elasticloadbalancing/latest/application/edit-target-group-attributes.md index 048ab6b29..3a9034bfc 100644 --- a//elasticloadbalancing/latest/application/edit-target-group-attributes.md +++ b//elasticloadbalancing/latest/application/edit-target-group-attributes.md @@ -7 +7 @@ -Deregistration delayRouting algorithmSlow start modeHealth settingsCross-zone load balancingAutomatic Target Weights (ATW)Sticky sessions +Deregistration delayRouting algorithmSlow start modeHealth settingsCross-zone load balancingAutomatic Target Weights (ATW)Sticky sessionsWAF HTTP/2 traffic inspection behavior @@ -28,0 +29,2 @@ After you create a target group for you Application Load Balancer, you can edit + * WAF HTTP/2 traffic inspection behavior + @@ -901,0 +904,60 @@ When scaling up, if the number of targets increase considerably, there is potent +## WAF HTTP/2 traffic inspection behavior + +By default, when you integrate Application Load Balancer with AWS WAF, AWS WAF inspects HTTP/2 requests immediately using the available request data. This inspection mode supports bidirectional streaming applications where the server must respond before the client completes sending request data, preventing timeouts in real-time communication scenarios. + +You can configure Application Load Balancer to accumulate HTTP/2 data frames before AWS WAF performs inspection. This configuration helps prevent security bypasses where attackers split malicious payloads across multiple HTTP/2 data frames. Use this option for standard request-response applications where clients transmit complete request data before expecting responses, ensuring AWS WAF inspects the full request payload. + +Console + + +###### To configure WAF HTTP/2 traffic inspection behavior + + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + + 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. + + 3. Choose the name of the target group to open its details page. + + 4. On the **Attributes** tab, choose **Edit**. + + 5. For **WAF HTTP/2 traffic inspection behavior** , choose the inspection mode. + + 6. Choose **Save changes**. + + + + +AWS CLI + + +###### To configure WAF HTTP/2 traffic inspection behavior + +Use the [modify-target-group-attributes](https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-target-group-attributes.html) command with the `waf.http2.traffic_inspection_behavior` attribute. + + + aws elbv2 modify-target-group-attributes \ + --target-group-arn target-group-arn \ + --attributes "Key=waf.http2.traffic_inspection_behavior,Value=inspect_after_sufficient_data" + +CloudFormation + + +###### To configure WAF HTTP/2 traffic inspection behavior + +Update the [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html) resource to include the `waf.http2.traffic_inspection_behavior` attribute. + + + Resources: + myTargetGroup: + Type: 'AWS::ElasticLoadBalancingV2::TargetGroup' + Properties: + Name: my-target-group + Protocol: HTTP + ProtocolVersion: HTTP2 + Port: 80 + TargetType: ip + VpcId: !Ref myVPC + TargetGroupAttributes: + - Key: "waf.http2.traffic_inspection_behavior" + Value: "inspect_after_sufficient_data" +