Enable WAF protection for SAE 2.0 custom domains

Background

SAE is a fully-managed and highly elastic platform for containerized applications. It supports various application types, including Spring Cloud, Dubbo, HSF, web applications, and jobs like XXL-JOB and ElasticJob. You can use SAE to host websites, mini-programs, mobile apps, and microservices. For more information about SAE, see What is Serverless App Engine?.

You can create applications in SAE 2.0 and bind custom domain names to them. This lets visitors access your applications by using the custom domain names.

WAF integrates with the native architecture of SAE 2.0 through an SDK module. This lets you enable security protection for custom domain names bound to your SAE 2.0 applications. WAF inspects traffic for malicious characteristics and forwards only safe traffic to your backend application, which protects it from attacks.

Limitations

• You can add Alibaba Cloud services such as Application Load Balancer (ALB), Microservices Engine (MSE), Function Compute (FC), Classic Load Balancer (CLB), Elastic Compute Service (ECS), Network Load Balancer (NLB), Serverless App Engine (SAE) 2.0, or API Gateway (APIG) to Web Application Firewall (WAF) in cloud native mode. To protect web applications that are not deployed on Alibaba Cloud, add their domain names to WAF in CNAME record mode. For more information, see Add a domain name to WAF.

• WAF protection can be enabled for SAE 2.0 custom domain names only in the following regions:

  • China (Hangzhou)

  • China (Shanghai)

  • China (Shenzhen)

  • China (Beijing)

  • China (Zhangjiakou)

• Protected objects that are added to WAF through SAE 2.0 do not support the following features:

  • Web tamper proofing

  • Data leakage prevention

  • Bot management: automatic integration of the web SDK in web crawler protection scenarios

  • API security

Prerequisites

• You have enabled the WAF 3.0 service for the Chinese Mainland region. For more information, see Activate Subscription WAF 3.0 or Activate Pay-As-You-Go WAF 3.0.

• If you use a subscription instance, ensure that your instance has sufficient quota to add protected objects. Otherwise, you cannot add cloud services.

  You can go to the Protected Objects page to view the remaining quota for protected objects.

• The custom domain name that you want to bind to the application has an ICP filing. For more information, see ICP filing process.

• You have created a DNS record to resolve the custom domain name to the endpoint of your application's region. For more information, see Access applications by using custom domain names.

Procedure

1. Log on to the WAF 3.0 console. In the top menu bar, select the resource group and the Chinese Mainland region for the WAF instance.

2. In the left navigation pane, click Onboarding.

3. Click the Cloud Service tab. In the list of cloud services on the left, select SAE, and then click Add.

4. On the SAE 2.0 console, click Enable and Experience SAE 2.0 Public Beta to enable SAE 2.0.

   Only SAE 2.0 supports WAF protection.

5. Follow the on-screen instructions and click Confirm Creation to automatically create a service-linked role. This role is used for application deployment, monitoring, and auto scaling.

   • The automatically created role is named AliyunServiceRoleForSAE.

   • The permission policy for the role is AliyunServiceRolePolicyForSAE.

   You can view the service-linked role that is automatically created for WAF on the Identities > Roles page in the RAM console.

   If you have already created the service-linked role, this step is skipped.

6. On the Application List page, click the Web Application tab to create an application. For more information, see Create an application.

7. On the Basic Information page of the application, in the Fully-managed HTTP Traffic section, click Create Custom Domain Name.

8. Configure the following parameters and click OK.

   Parameter	Description
   Domain name	Enter a custom domain name. You can use a single domain name, such as www.aliyun.com, or a wildcard domain name, such as *.aliyun.com.
   HTTPS	Enable or disable HTTPS access for the custom domain name. Valid values: Enable: Enables HTTPS access for the custom domain name. This lets the domain be accessed over both HTTP and HTTPS. Note You can also select the Force HTTPS checkbox. If you do, SAE 2.0 redirects all HTTP requests for the domain name to HTTPS. Disable: Disables HTTPS access for the custom domain name. This lets the domain be accessed only over HTTP. HTTPS requests will fail.
   Certificate type	This parameter is required if you enable HTTPS access. Select the type of certificate to upload. Valid values: Alibaba Cloud SSL Certificate: Select an Alibaba Cloud SSL certificate. If the Certificate Name drop-down list is empty, you do not have any certificates. You can go to the Certificate Management Service console to purchase one. For more information, see Purchase a commercial certificate. Manual Upload: Enter a Certificate Name and paste the content of the certificate and its private key into the PEM Certificate Content and PEM Certificate Key fields. The certificate file cannot exceed 20 KB and the key file cannot exceed 4 KB.
   TLS protocol version	This parameter is required if you enable HTTPS access. Select the TLS protocol versions that the application supports. If you do not configure this parameter, TLS 1.0, 1.1, and 1.2 are supported by default. Valid values: Support TLS 1.0 and later protocols, with the highest compatibility and lowest security: Supports TLS 1.0, 1.1, and 1.2. Support TLS 1.1 and later protocols, with good compatibility and good security: Supports TLS 1.1 and 1.2. Requests that use TLS 1.0 will fail. Support TLS 1.2 and later protocols, with good compatibility and the highest security: Supports only TLS 1.2. Requests that use TLS 1.0 or TLS 1.1 will fail. Note After you select a TLS protocol version, you can also select the Enable Support for TLS 1.3 checkbox to add support for TLS 1.3.
   Cipher suite	This parameter is required if you enable HTTPS access. Select a TLS cipher suite. If you do not configure this parameter, all cipher suites are selected by default. Valid values: All cipher suites, with the highest compatibility and lowest security: Selects all cipher suites, including both strong and weak ones. Strong cipher suites TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 Weak cipher suites TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA TLS_ECDHE_RSA_WITH_RC4_128_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 Custom cipher suites for the protocol version, please choose carefully to avoid affecting your business: Select a subset of the supported cipher suites from the drop-down list. You can click the icon next to a weak cipher suite to remove it. Important Choose custom cipher suites with caution to ensure that the server and client suites match. For more information about TLS protocol versions and their supported cipher suites, see Access applications by using custom domain names. SAE 2.0 uses RFC naming conventions for cipher suites. For more information about the differences between RFC and OpenSSL naming conventions for cipher suites, see Access applications by using custom domain names.
   Web Application Firewall	Enable Web Application Firewall. When enabled, WAF provides one-stop security protection for your application. It identifies malicious characteristics in web traffic to prevent intrusions and ensure business and data security.

   After you apply these settings, WAF protects the application's custom domain name. You can view the domain name on the Access Management > Cloud Service > SAE tab.

   WAF also automatically creates a protected object named "ApplicationID-CustomDomainName-sae" and enables the core web protection rule set for it by default. You can then view the new protected object on the Protected Objects page in the WAF console and configure its protection rules. For more information, see Overview.

   

References

• For information about how to create, update, delete, start, and stop applications in the SAE 2.0 console, see Manage applications.

• For information about how to bind a custom domain name to an application in SAE 2.0, see Access applications by using custom domain names.