Optional: Update the CloudFormation stack to add Basic Auth using AWS CLI

If you previously configured the Generic Firewall Denylist integration and want to add support for Basic Auth, you can update your existing CloudFormation stack using AWS CLI.

  1. Open a local terminal with AWS CLI installed, or open AWS CloudShell in a browser.
  2. Optional: If you are using CloudShell, select Actions > Upload file to upload the JSON file from Configure an AWS S3 bucket for firewall Active Response.
  3. Run this command:
    SHELL 
    aws cloudformation deploy \
  --template-file <template_filepath> \
  --stack-name <stack_name> \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides \
  FirewallIPs='<firewall_ip_addresses>'
  BasicAuthUsername='<basic_auth_username>'
    Where:
    • template_filepath is the filepath for the deny_list_cfn JSON template. If you are using CloudShell, the filepath is simply the name of the file. For example, deny_list_cfn.json.
    • stack_name is the name of the stack, for example firewall-deny-list.
    • firewall_ip_addresses is a comma-separated list of the IP addresses for the firewalls that require access to the denylist to apply it to your network traffic. For example 0.0.0.0,8.8.8.8.
      Note: These are IP addresses that need to read the denylist, not the IP addresses included in the denylist. The IP addresses should be public WAN IP addresses, not management IP addresses.
    • basic_auth_username is the username for HTTP Basic Authentication.
    Expected output:
    CODE 
    Waiting for changeset to be created..
Waiting for stack create/update to complete
Successfully created/updated stack - firewall-deny-list
  4. In any existing products previously configured to use the Generic Firewall Denylist integration, update the URL with the value found of GetDenyListIPAllowlistUrl in the Stack Formation output.