Unlike the Google ReCaptcha and most other similar services which require you to modify your application to implement a Captcha, AWS WAF Captcha requires no code modification because it acts as a layer above your application.ĪWS WAF Captcha can be used to protect resources behind application load balancers, as well as Amazon API Gateway, and AWS AppSync. Make sure to change the profile (three times in the one liner) and add -region if you need to use another one then your default configured.AWS WAF Captcha is a feature within AWS WAF (Web Application Firewall) that lets you easily block bot traffic by presenting users with a task they need to complete before allowing them to access the page.ĪWS Captcha is extremely easy to setup. So I started to write a one-liner in bash using aws cli v2 (tested on Ubuntu 20.04 & macos big sur) to do that for me. I quickly decided that we would not spend time on doing an inventory on what authorization each resource is configured with in all the 312 API Gateway endpoints in production. It started with my colleague and I needing to do an inventory, We needed to understand our public exposed resources that were not protected by a authorization mechanism that is handled by AWS API Gateway (IAM, API keys etc). Well, I actually changed my prioritization as we found that 7% of our API Gateways were not supposed to be public and were exposing us for to risk. I had and I needed it to understand what API Gateway endpoints I would like to focus on for our AWS WAF rollout to minimize the risk of direct external threat / attack for the company I work for.

Have you ever had the need to quickly audit your unauthenticated & public exposure of your API Gateway resources to plan a implementation of AWS WAF (Web Application Firewall)?

Aws waf api gateway