# AWS WaF HTTP header analyzer | The Purpose Of The Project Is To Create Rate Limit In AWS WaF Based On HTTP Headers

**URL:** <https://onehack.st/t/aws-waf-http-header-analyzer-the-purpose-of-the-project-is-to-create-rate-limit-in-aws-waf-based-on-http-headers/263540>\
**Category:** Tools & Scripts\
**Tags:** cloud-storage\
**Created:** [November 10, 2023, 1:59am UTC](https://onehack.st/t/aws-waf-http-header-analyzer-the-purpose-of-the-project-is-to-create-rate-limit-in-aws-waf-based-on-http-headers/263540 "2023-11-10T01:59:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [November 10, 2023, 1:59am UTC](https://onehack.st/t/aws-waf-http-header-analyzer-the-purpose-of-the-project-is-to-create-rate-limit-in-aws-waf-based-on-http-headers/263540/1 "2023-11-10T01:59:53Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/7/67af7f606f0c11d6b51bc24870811f0d2703d1cd.png)

### [AWS WaF HTTP header analyzer](https://github.com/0dutra/aws-waf-header-analyzer#aws-waf-http-header-analyzer)

[![](https://camo.githubusercontent.com/5ea3ed88a93cadeb5e541f7fa27095266cf85ba1908ebc3fac402f3c809ce2ee/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f747769747465722d406e756c6c64757472612d626c75652e737667) ](https://twitter.com/nulldutra)[![](https://github.com/nulldutra/aws-waf-header-analyzer/actions/workflows/release.yaml/badge.svg)](https://github.com/nulldutra/aws-waf-header-analyzer/actions/workflows/release.yaml)

* * *

## [Building and install](https://github.com/0dutra/aws-waf-header-analyzer#building-and-install)

Golang is a dependencie to build the binary. See the documentation to install: [https://go.dev/doc/install](https://go.dev/doc/install)

make sudo make install

## [Rules](https://github.com/0dutra/aws-waf-header-analyzer#rules)

The rules configuration is very simple, for example, the threshold is the limited of the requests in X time. It’s possible to monitoring multiples headers, but, the header needs to be in HTTP Request header log.

### [Config example](https://github.com/0dutra/aws-waf-header-analyzer#config-example)

rules: header: x-api-id: # The header name in HTTP Request header threshold: 100 token: threshold: 1000

## [Notifications](https://github.com/0dutra/aws-waf-header-analyzer#notifications)

It’s possible send notifications to Slack and Telegram. To configure slack notifications, you needs create a webhook configuration, see the slack documentation: [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)

Telegram bot father: [https://t.me/botfather](https://t.me/botfather)

### [Config example](https://github.com/0dutra/aws-waf-header-analyzer#config-example-1)

notifications: slack: webhook-url: [https://hooks.slack.com/services/DA2DA13QS/LW5DALDSMFDT5/qazqqd4f5Qph7LgXdZaHesXs](https://hooks.slack.com/services/DA2DA13QS/LW5DALDSMFDT5/qazqqd4f5Qph7LgXdZaHesXs) telegram: bot-token: “123456789:NNDa2tbpq97izQx\_invU6cox6uarhrlZDfa” chat-id: “-4128833322”

## [AWS](https://github.com/0dutra/aws-waf-header-analyzer#aws)

### [Credentials](https://github.com/0dutra/aws-waf-header-analyzer#credentials)

To set up AWS credentials, it’s advisable to export them as environment variables. Here’s a recommended approach:

export AWS\_ACCESS\_KEY\_ID=“..” export AWS\_SECRET\_ACCESS\_KEY=“..” export AWS\_REGION=“us-east-1”

### [Log group](https://github.com/0dutra/aws-waf-header-analyzer#log-group)

retrive-logs-minutes-ago is the time range you want to fetch the logs, in this example, logs from 1 hour ago.

aws: waf-log-group-name: aws-waf-logs-cloudwatch-cloudfront region: us-east-1 retrive-logs-minutes-ago: 60

## GitHub:

[https://github.com/0dutra/aws-waf-header-analyzer](https://github.com/0dutra/aws-waf-header-analyzer)