AWS WAF率限制每个主机名

Question

到目前为止，我们一直在为一个主机使用速率限制规则-300个每5分钟的请求foo.dev.com（输入回复到ALB）

，现在我们想将更多规则拆分，所以我们对不同的主机名（all veral asl Same Alb）有不同的规则，因此我们可以实现：

• aaa-foo.dev.com - 每5分钟100个请求
• bbb-foo.dev。 com - 每5分钟的200个请求

aaa和bbb将是我们的应用程序将服务的不同客户端，

请提供一些提示！

Answer 1

这是我设法解决此问题的方式，使用bytematchstatement比较主机标头starts_with'{clientname}'，希望它可以帮助某人：

{
  "Name": "foobar-acl",
  "DefaultAction": {
    "Allow": {}
  },
  "Description": "",
  "Rules": [
    {
      "Name": "rate-limit-main",
      "Priority": 0,
      "Statement": {
        "RateBasedStatement": {
          "Limit": 3000,
          "AggregateKeyType": "IP"
        }
      },
      "Action": {
        "Block": {
          "CustomResponse": {
            "ResponseCode": 429,
            "CustomResponseBodyKey": "html_responce"
          }
        }
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": false,
        "CloudWatchMetricsEnabled": false,
        "MetricName": "foobar-rate-limit-main"
      }
    },
    {
      "Name": "rate-limit-clientname",
      "Priority": 1,
      "Statement": {
        "RateBasedStatement": {
          "Limit": 100,
          "AggregateKeyType": "IP",
          "ScopeDownStatement": {
            "ByteMatchStatement": {
              "SearchString": "clientname",
              "FieldToMatch": {
                "SingleHeader": {
                  "Name": "host"
                }
              },
              "TextTransformations": [
                {
                  "Priority": 1,
                  "Type": "NONE"
                }
              ],
              "PositionalConstraint": "STARTS_WITH"
            }
          }
        }
      },
      "Action": {
        "Block": {
          "CustomResponse": {
            "ResponseCode": 409,
            "CustomResponseBodyKey": "html_responce"
          }
        }
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": false,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "foobar-clientname"
      }
    },
    {
      "Name": "rate-limit-clientname2",
      "Priority":21,
      "Statement": {
        "RateBasedStatement": {
          "Limit": 100,
          "AggregateKeyType": "IP",
          "ScopeDownStatement": {
            "ByteMatchStatement": {
              "SearchString": "clientname2",
              "FieldToMatch": {
                "SingleHeader": {
                  "Name": "host"
                }
              },
              "TextTransformations": [
                {
                  "Priority": 2,
                  "Type": "NONE"
                }
              ],
              "PositionalConstraint": "STARTS_WITH"
            }
          }
        }
      },
      "Action": {
        "Block": {
          "CustomResponse": {
            "ResponseCode": 409,
            "CustomResponseBodyKey": "html_responce"
          }
        }
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": false,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "foobar-clientname2"
      }
    }
  ],
  "VisibilityConfig": {
    "SampledRequestsEnabled": false,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "foobar-acl"
  },
  "Capacity": 6,
  "ManagedByFirewallManager": false,
  "CustomResponseBodies": {
    "html_responce": {
      "ContentType": "TEXT_HTML",
      "Content": "<div>You exceeded the maximum number of requests !</div>"
    }
  }
}