Table: aws_wafregional_rule - Query AWS WAF Regional Rules using SQL

The AWS WAF Regional Rule is a feature of AWS WAF, a web application firewall that helps protect your web applications from common web exploits. It allows you to create custom rules that block common attack patterns, such as SQL injection or cross-site scripting (XSS), and rules that are designed for your specific application. These rules can be used in AWS WAF to block or allow requests based on conditions that you specify.

Table Usage Guide

The aws_wafregional_rule table in Steampipe provides you with information about AWS WAF Regional Rules. This table allows you as a DevOps engineer to query rule-specific details, including its ID, metric name, name, and the predicates associated with it. You can utilize this table to gather insights on rules, such as the types of patterns that AWS WAF searches for, whether AWS WAF is set to allow, block, or count web requests, and more. The schema outlines the various attributes of the AWS WAF Regional Rule for you, including the rule ARN, rule ID, metric name, and associated predicates.

Examples

Basic info

Determine the areas in which specific rules and associated metrics are applied within your AWS WAF regional setup. This can help you understand the reach and impact of your security configurations.

select
  name,
  rule_id,
  metric_name
from
  aws_wafregional_rule;

select
  name,
  rule_id,
  metric_name
from
  aws_wafregional_rule;

Get predicate details for each rule

Determine the specifics of each rule in your AWS WAF Regional setup, including whether conditions are negated and the type of data being evaluated. This allows for a comprehensive review of your security settings, helping identify potential weak points or areas for improvement.

select
  name,
  rule_id,
  p ->> 'DataId' as data_id,
  p ->> 'Negated' as negated,
  p ->> 'Type' as type
from
  aws_wafregional_rule,
  jsonb_array_elements(predicates) as p;

select
  name,
  rule_id,
  json_extract(p.value, '$.DataId') as data_id,
  json_extract(p.value, '$.Negated') as negated,
  json_extract(p.value, '$.Type') as type
from
  aws_wafregional_rule,
  json_each(predicates) as p;

Control examples

Schema for aws_wafregional_rule

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
account_id	text	=, !=, ~~, ~~, !~~, !~~	The AWS Account ID in which the resource is located.
akas	jsonb		Array of globally unique identifier strings (also known as) for the resource.
arn	text		Amazon Resource Name (ARN) of the Rule.
metric_name	text		A friendly name or description for the metrics for this Rule.
name	text		The friendly name or description for the Rule.
partition	text		The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
predicates	jsonb		The Predicates object contains one Predicate element for each ByteMatchSet,IPSet, or SqlInjectionMatchSet object that you want to include in a Rule.
region	text		The AWS Region in which the resource is located.
rule_id	text	=	A unique identifier for a Rule.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
title	text		Title of the resource.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws

You can pass the configuration to the command with the --config argument:

steampipe_export_aws --config '<your_config>' aws_wafregional_rule