Description:

This check verifies that every Utho Cloud Load Balancer exposed to public Internet traffic has a Web Application Firewall (WAF) attached. A WAF helps inspect and filter HTTP/HTTPS traffic and protect applications from common web-based attacks.


Rationale:

Public-facing Load Balancers are directly exposed to Internet traffic and can become an entry point for application-layer attacks.

This check helps:

  • Protect applications from common web attacks.

  • Filter malicious HTTP/HTTPS requests.

  • Reduce the application attack surface.

  • Improve web application security and compliance.


Impact:

  • Provides an additional security layer for public applications.

  • Helps block malicious web traffic before it reaches backend servers.

  • WAF rules may block legitimate traffic if incorrectly configured.

  • Additional WAF processing may introduce minor request latency.


Default Value:

Every public-facing Utho Cloud Load Balancer should have a WAF attached.

A Load Balancer is considered non-compliant if it is publicly accessible and does not have an associated WAF.


Pre-requisites:

  • Utho Cloud account.

  • Permissions to view Load Balancers and WAF configurations.

  • Access to the Utho Cloud Console or Utho API.

  • Public-facing Load Balancers configured in the account.


Test Plan:

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Networking → Load Balancer.

  3. List all Load Balancers.

  4. Identify Load Balancers exposed to public Internet traffic.

  5. Check whether a WAF is attached to each public-facing Load Balancer in WAF.

  6. In the resource section, check whether WAF is attached to an Internet-facing Load Balancer.


Using the Utho API:

List all Load Balancers:

curl -s \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/loadbalancer

Check weather Load Balancer is attached to the WAF

curl -X GET "https://api.utho.com/v2/waf?action=list" \
  -H "Authorization: Bearer $UTHO_API_TOKEN" \
  -H "Content-Type: application/json" | jq
If the load balancer is attached to the WAF it will appear in the instance section the load balancer id appers in the instance section.

Implementation Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to the WAF under the Networking section.

         

  1. Create or select an appropriate WAF. Click on the WAF name or on Manage.

  1. In the Resource section, click on Attach Load Balancer.

  1. Select the Internet-facing load balancer and click on Load Balancer.

  1. Save the configuration.

  2. Verify that the WAF is active and protecting the Load Balancer.


Using the Utho API:

Utho provides WAF and Load Balancer API endpoints. Use the WAF API to attach the Load Balancer to the appropriate WAF according to the API version available in the environment.


Backout Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to the WAF under the Networking section.

  3. Create or select an appropriate WAF. Click on the WAF name or on Manage.

  4. In the Resource section, under the protected resource, detach the internet-facing load balancer.


References: