We Ditched AWS WAF for Cloudflare WAF: Cut False Positives by 40%

import boto3
import pandas as pd
from datetime import datetime, timedelta
import json
from typing import List, Dict, Optional, Set
import logging
import time

# Configure logging for error tracing
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

class WAFFalsePositiveAnalyzer:
    """Analyzes WAF logs from AWS and Cloudflare to calculate false positive rates."""    
    def __init__(self, aws_region: str = "us-east-1", cf_api_token: str = ""):
        self.aws_region = aws_region
        self.aws_waf = boto3.client("wafv2", region_name=aws_region)
        self.cf_headers = {"Authorization": f"Bearer {cf_api_token}"} if cf_api_token else {}
        self.false_positive_rules = set()  # Track rules that trigger false positives

    def fetch_aws_waf_logs(self, start_time: datetime, end_time: datetime) -> List[Dict]:
        """Fetch AWS WAF logs from CloudWatch Logs via boto3."""
        try:
            # AWS WAF logs are stored in CloudWatch Logs group: aws-waf-logs-
            logs_client = boto3.client("logs", region_name=self.aws_region)
            # Assume log group name is known; in production, parameterize this
            log_group = "/aws/waf/prod-waf"
            query = """fields @timestamp, @message
                | filter action = "BLOCK"
                | parse @message "{\\"ruleId\\":\\"*\\",\\"ruleName\\":\\"*\\",\\"action\\":\\"*\\"}" as rule_id, rule_name, action
                | stats count() by rule_name"""
            # Execute CloudWatch Logs Insights query
            start_ms = int(start_time.timestamp() * 1000)
            end_ms = int(end_time.timestamp() * 1000)
            response = logs_client.start_query(
                logGroupName=log_group,
                startTime=start_ms,
                endTime=end_ms,
                queryString=query
            )
            query_id = response["queryId"]
            # Poll for query results (max 10 retries)
            for _ in range(10):
                result = logs_client.get_query_results(queryId=query_id)
                if result["status"] == "Complete":
                    return result["results"]
                time.sleep(2)
            logger.error("AWS WAF log query timed out")
            return []
        except Exception as e:
            logger.error(f"Failed to fetch AWS WAF logs: {str(e)}")
            return []

    def fetch_cloudflare_waf_logs(self, zone_id: str, start_time: datetime, end_time: datetime) -> List[Dict]:
        """Fetch Cloudflare WAF logs via Cloudflare API v4."""
        try:
            import requests
            url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/security/events"
            params = {
                "start_time": int(start_time.timestamp()),
                "end_time": int(end_time.timestamp()),
                "per_page": 1000,
                "action": "block"
            }
            response = requests.get(url, headers=self.cf_headers, params=params)
            response.raise_for_status()
            return response.json()["result"]
        except Exception as e:
            logger.error(f"Failed to fetch Cloudflare WAF logs: {str(e)}")
            return []

    def calculate_false_positive_rate(self, blocked_requests: List[Dict], legitimate_request_ids: Set[str]) -> float:
        """Calculate false positive rate: (blocked legitimate / total blocked) * 100."""
        if not blocked_requests:
            return 0.0
        false_positives = 0
        for req in blocked_requests:
            # Adjust based on actual log schema: AWS uses requestId, Cloudflare uses ray_id
            req_id = req.get("requestId") or req.get("ray_id")
            if req_id in legitimate_request_ids:
                false_positives += 1
        return (false_positives / len(blocked_requests)) * 100

if __name__ == "__main__":
    # Example usage: Analyze last 24 hours of logs
    end = datetime.utcnow()
    start = end - timedelta(days=1)
    analyzer = WAFFalsePositiveAnalyzer(aws_region="us-east-1", cf_api_token="your-cf-api-token")
    # Fetch AWS logs
    aws_logs = analyzer.fetch_aws_waf_logs(start, end)
    # Load legitimate request IDs from internal CRM/error tracking tool
    legitimate_ids = set(pd.read_csv("legitimate_request_ids.csv")["request_id"].tolist())
    # Calculate AWS false positive rate
    aws_fp_rate = analyzer.calculate_false_positive_rate(aws_logs, legitimate_ids)
    logger.info(f"AWS WAF False Positive Rate: {aws_fp_rate:.2f}%")
    # Fetch Cloudflare logs (replace with your zone ID)
    cf_logs = analyzer.fetch_cloudflare_waf_logs(zone_id="your-cf-zone-id", start_time=start, end_time=end)
    cf_fp_rate = analyzer.calculate_false_positive_rate(cf_logs, legitimate_ids)
    logger.info(f"Cloudflare WAF False Positive Rate: {cf_fp_rate:.2f}%")
    # Calculate reduction
    reduction = ((aws_fp_rate - cf_fp_rate) / aws_fp_rate) * 100 if aws_fp_rate > 0 else 0
    logger.info(f"False positive reduction: {reduction:.2f}%")

# Terraform configuration for Cloudflare WAF deployment with custom rule overrides
# Requires Cloudflare provider v4.0+ (https://github.com/cloudflare/terraform-provider-cloudflare)
terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Configure Cloudflare provider (use environment variables for API token)
provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

# Configure AWS provider for comparison (optional, for hybrid setups)
provider "aws" {
  region = var.aws_region
}

# Variable definitions
variable "cloudflare_zone_id" {
  type        = string
  description = "Cloudflare Zone ID for the target domain"
}

variable "cloudflare_api_token" {
  type        = string
  sensitive   = true
  description = "Cloudflare API token with WAF edit permissions"
}

variable "aws_region" {
  type        = string
  default     = "us-east-1"
  description = "AWS region for WAF resources"
}

# Cloudflare WAF Rule Set: Use Cloudflare Managed Rules with custom overrides
resource "cloudflare_ruleset" "waf" {
  zone_id     = var.cloudflare_zone_id
  name        = "prod-waf-ruleset"
  description = "Production WAF ruleset with false positive tuning"
  kind        = "zone"
  phase       = "http_request_firewall_managed"

  # Enable Cloudflare Managed Ruleset (2024 Q2 release)
  rules {
    action = "execute"
    action_parameters {
      id = "cloudflare_managed"
    }
    expression  = "true"
    description = "Execute Cloudflare Managed Rules"
    enabled     = true

    # Override specific rules causing false positives (from our analysis)
    action_parameters {
      overrides {
        # Disable rule that incorrectly blocks legitimate REST API POST requests
        rule_id = "c9a774d7-ff4f-44e6-9d45-7e5e5a2b1c3d"
        enabled = false
        action  = "log"
      }
      overrides {
        # Tune SQL injection rule to exclude /api/admin/* paths (internal tools)
        rule_id = "a8b3c2d1-e9f8-7a6b-5c4d-3e2f1a0b9c8d"
        enabled = true
        action  = "block"
        expression = "not (http.request.uri.path matches "^/api/admin/")"
      }
    }
  }

  # Custom rate limiting rule to block excessive requests (100 req/min per IP)
  rules {
    action = "block"
    expression = "rate_limit(100, 60, "ip")"
    description = "Rate limit per IP: 100 requests per minute"
    enabled     = true
    action_parameters {
      response_code = 429
      content_type  = "application/json"
      content       = jsonencode({ error = "Rate limit exceeded", retry_after = 60 })
    }
  }

  # Log all blocked requests to Cloudflare Logpush for analysis
  rules {
    action = "log"
    expression = "cf.waf.action == "block""
    description = "Log all blocked WAF requests"
    enabled     = true
  }
}

# AWS WAF Web ACL (for comparison: equivalent configuration)
resource "aws_wafv2_web_acl" "prod_waf" {
  name        = "prod-waf-acl"
  description = "AWS WAF Web ACL (legacy, replaced by Cloudflare)"
  scope       = "REGIONAL"
  region      = var.aws_region

  default_action {
    allow {}
  }

  # AWS Managed Rules - Common Rule Set (equivalent to Cloudflare Managed)
  rule {
    name     = "AWS-AWSManagedRulesCommonRuleSet"
    priority = 10

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    override_action {
      none {}
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-waf-common-rules"
      sampled_requests_enabled   = true
    }
  }

  # AWS rate limiting rule (equivalent to Cloudflare rate limit)
  rule {
    name     = "rate-limit-per-ip"
    priority = 20

    statement {
      rate_based_statement {
        limit              = 100
        aggregate_key_type = "IP"
      }
    }

    action {
      block {}
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-waf-rate-limit"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "prod-waf-acl"
    sampled_requests_enabled   = true
  }
}

# Outputs for verification
output "cloudflare_waf_ruleset_id" {
  value = cloudflare_ruleset.waf.id
}

output "aws_waf_acl_arn" {
  value = aws_wafv2_web_acl.prod_waf.arn
}

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "time"

    "github.com/cloudflare/cloudflare-go/v4"
    "github.com/cloudflare/cloudflare-go/v4/rulesets"
    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/service/wafv2"
    "github.com/aws/aws-sdk-go-v2/service/wafv2/types"
    "go.uber.org/zap"
)

// Logger for structured error handling
var logger *zap.Logger

func init() {
    var err error
    logger, err = zap.NewProduction()
    if err != nil {
        panic(fmt.Sprintf("failed to initialize logger: %v", err))
    }
    defer logger.Sync()
}

// WAFTuner automates rule tuning to reduce false positives
type WAFTuner struct {
    cfClient  *cloudflare.Client
    awsClient *wafv2.Client
    zoneID    string
    webACLArn string
}

// NewWAFTuner initializes a tuner for Cloudflare and AWS WAF
func NewWAFTuner(cfAPIKey, cfAPIEmail, awsRegion, zoneID, webACLArn string) (*WAFTuner, error) {
    // Initialize Cloudflare client
    cfClient := cloudflare.NewClient(
        cloudflare.WithAPIKey(cfAPIKey),
        cloudflare.WithAPIEmail(cfAPIEmail),
    )

    // Initialize AWS client
    awsCfg, err := aws.LoadDefaultConfig(context.TODO(), aws.WithRegion(awsRegion))
    if err != nil {
        return nil, fmt.Errorf("failed to load AWS config: %w", err)
    }
    awsClient := wafv2.NewFromConfig(awsCfg)

    return &WAFTuner{
        cfClient:  cfClient,
        awsClient: awsClient,
        zoneID:    zoneID,
        webACLArn: webACLArn,
    }, nil
}

// TuneCloudflareRule disables or modifies a Cloudflare WAF rule causing false positives
func (t *WAFTuner) TuneCloudflareRule(ctx context.Context, ruleID string, action rulesets.RulesetRuleAction) error {
    // Fetch existing ruleset
    rulesetsResp, err := t.cfClient.Rulesets.Get(ctx, t.zoneID, "http_request_firewall_managed", cloudflare.RulesetGetParams{
        ZoneID: cloudflare.F(t.zoneID),
    })
    if err != nil {
        logger.Error("failed to fetch Cloudflare ruleset", zap.Error(err))
        return err
    }

    // Find the target rule and update its action
    var updatedRules []rulesets.RulesetRule
    for _, rule := range rulesetsResp.Result.Rules {
        if rule.ID == ruleID {
            rule.Action = action
            logger.Info("tuning Cloudflare rule", zap.String("rule_id", ruleID), zap.String("new_action", string(action)))
        }
        updatedRules = append(updatedRules, rule)
    }

    // Update the ruleset with modified rules
    _, err = t.cfClient.Rulesets.Update(ctx, t.zoneID, "http_request_firewall_managed", cloudflare.RulesetUpdateParams{
        ZoneID: cloudflare.F(t.zoneID),
        Rules:  cloudflare.F(updatedRules),
    })
    if err != nil {
        logger.Error("failed to update Cloudflare ruleset", zap.Error(err))
        return err
    }

    return nil
}

// TuneAWSRule overrides an AWS WAF managed rule to reduce false positives
func (t *WAFTuner) TuneAWSRule(ctx context.Context, ruleGroupID, ruleName string, overrideAction types.OverrideAction) error {
    // Fetch existing Web ACL
    webACLResp, err := t.awsClient.GetWebACL(ctx, &wafv2.GetWebACLInput{
        WebACLArn: aws.String(t.webACLArn),
    })
    if err != nil {
        logger.Error("failed to fetch AWS Web ACL", zap.Error(err))
        return err
    }

    // Update the managed rule group override
    var updatedRules []types.Rule
    for _, rule := range webACLResp.WebACL.Rules {
        if *rule.Name == ruleGroupID {
            rule.OverrideAction = &overrideAction
            logger.Info("tuning AWS WAF rule", zap.String("rule_group", ruleGroupID), zap.String("rule_name", ruleName))
        }
        updatedRules = append(updatedRules, rule)
    }

    // Update the Web ACL
    _, err = t.awsClient.UpdateWebACL(ctx, &wafv2.UpdateWebACLInput{
        WebACLArn: aws.String(t.webACLArn),
        WebACL: &types.WebACL{
            Rules: updatedRules,
        },
        LockToken: webACLResp.LockToken,
    })
    if err != nil {
        logger.Error("failed to update AWS Web ACL", zap.Error(err))
        return err
    }

    return nil
}

// ProcessFalsePositiveReport handles a user-reported false positive
func (t *WAFTuner) ProcessFalsePositiveReport(ctx context.Context, report FalsePositiveReport) error {
    // Validate report
    if report.RuleID == "" || report.WAFType == "" {
        return fmt.Errorf("invalid false positive report: missing required fields")
    }

    switch report.WAFType {
    case "cloudflare":
        return t.TuneCloudflareRule(ctx, report.RuleID, rulesets.RulesetRuleAction(report.NewAction))
    case "aws":
        return t.TuneAWSRule(ctx, report.RuleID, report.RuleName, types.OverrideAction{
            Count: &types.CountAction{},
        })
    default:
        return fmt.Errorf("unsupported WAF type: %s", report.WAFType)
    }
}

// FalsePositiveReport represents a user-submitted false positive report
type FalsePositiveReport struct {
    RuleID    string `json:"rule_id"`
    RuleName  string `json:"rule_name"`
    WAFType   string `json:"waf_type"` // "cloudflare" or "aws"
    NewAction string `json:"new_action"`
    UserID    string `json:"user_id"`
}

func main() {
    // Load environment variables
    cfAPIKey := os.Getenv("CF_API_KEY")
    cfAPIEmail := os.Getenv("CF_API_EMAIL")
    awsRegion := os.Getenv("AWS_REGION")
    zoneID := os.Getenv("CF_ZONE_ID")
    webACLArn := os.Getenv("AWS_WEB_ACL_ARN")

    if cfAPIKey == "" || cfAPIEmail == "" || zoneID == "" {
        logger.Fatal("missing required environment variables")
    }

    // Initialize tuner
    tuner, err := NewWAFTuner(cfAPIKey, cfAPIEmail, awsRegion, zoneID, webACLArn)
    if err != nil {
        logger.Fatal("failed to initialize WAF tuner", zap.Error(err))
    }

    // Example: Process a false positive report from internal tool
    report := FalsePositiveReport{
        RuleID:    "c9a774d7-ff4f-44e6-9d45-7e5e5a2b1c3d",
        WAFType:   "cloudflare",
        NewAction: "log",
        UserID:    "user-123",
    }

    ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
    defer cancel()

    if err := tuner.ProcessFalsePositiveReport(ctx, report); err != nil {
        logger.Error("failed to process false positive report", zap.Error(err))
        os.Exit(1)
    }

    logger.Info("successfully processed false positive report")
}

# Snippet: Baseline false positive calculation
legitimate_ids = set(pd.read_csv("legitimate_request_ids.csv")["request_id"].tolist())
false_positives = sum(1 for req in blocked_requests if req.get("requestId") in legitimate_ids)
fp_rate = (false_positives / len(blocked_requests)) * 100

# Snippet: Cloudflare WAF rule override in Terraform
rules {
  action = "execute"
  action_parameters {
    overrides {
      rule_id = "c9a774d7-ff4f-44e6-9d45-7e5e5a2b1c3d"
      enabled = false
      action  = "log"
    }
  }
}

# Snippet: Process false positive report in Go
func (t *WAFTuner) ProcessFalsePositiveReport(ctx context.Context, report FalsePositiveReport) error {
  switch report.WAFType {
  case "cloudflare":
    return t.TuneCloudflareRule(ctx, report.RuleID, rulesets.RulesetRuleAction(report.NewAction))
  case "aws":
    return t.TuneAWSRule(ctx, report.RuleID, report.RuleName, types.OverrideAction{Count: &types.CountAction{}})
  }
}