AI BriefingOperating and Improving a Multi-Account NACL Blocking Automation Tool
Key point
This covers the operation and improvement process of an NACL automation tool built by Woowa Brothers' security team to efficiently block attacker IPs across dozens of AWS accounts.
Details
Woowa Brothers developed and operates the WOOWA-SOC-ACL-IR tool to quickly block attacker IPs across an environment of dozens of AWS accounts separated by service. The existing manual blocking method had limitations in that omissions and delays occurred as the number of accounts increased.
The initial architecture was designed as a simple structure where API Gateway receives requests, passes them through an SQS FIFO queue, and Lambda adds Deny rules to each account's NACL. At this point, blocking history is recorded in DynamoDB, and to resolve the NACL slot shortage issue, a Rotation method is used that deletes the oldest rule and fills in the new rule.
To resolve state inconsistency issues that arose during operation, the following features were added.
- alldelete: A feature that resets all Deny rules registered in slots 21-50 and the corresponding DynamoDB entries at once
- sync_check: A feature that checks the consistency between the actual NACL configuration and the records in DynamoDB
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
AWS Introduces Enhanced Custom Event Buses for Organization-Wide Event Sharing