Sync Abuse.ch JA3 blocklist into AWS WAF
Build a scheduled workflow that retrieves the Suricata JA3 fingerprint blocklist from Abuse.ch. Transform the entries into AWS WAF rule statements and create or update the target WAF rule group, respecting WAF size limits by batching. Diff against the current rules to add/remove fingerprints, retry AWS API failures, and validate the feed parsed correctly before applying. Output the count of fingerprints synced and any changes made.
What this prompt builds
Pull the Abuse.ch JA3 fingerprint blocklist and keep an AWS WAF rule group blocking those clients up to date.
The problem
Malicious TLS clients are identifiable by JA3 fingerprint, but threat feeds update constantly and manually maintaining WAF rules from them doesn't scale. Stale blocklists let known-bad clients through.
Solution and impact
This workflow fetches the Abuse.ch JA3 blocklist and creates/updates an AWS WAF rule group to block those fingerprints automatically. Defenses stay current with the feed without manual upkeep.