# Ensure Cloudfront distributions are using WAF - Source: https://support.icompaas.com/support/solutions/articles/62000223750-ensure-cloudfront-distributions-are-using-waf - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security or consume excessive resources. AWS WAF allows you to monitor HTTP and HTTPS requests that are forwarded to Amazon Cloudfront, Application Load Balancer, and API Gateway. AWS WAF can configure conditions such as what IPs are allowed to make these requests or what query string parameters need to be passed for the request to be allowed, Then the Application Load Balancer or Cloudfront will either allow this content to be received or give it an HTTP 403 status code which is permission denied. **Rationale:** Ensure all your AWS Cloudfront web distributions are integrated with the web application firewall (AWS WAF) service to protect attacks on your applications on the internet that can affect the security of your web applications or place unnecessary load and resource usage. ### I**mpact:** With AWS Cloudfront WAF enabled you will be able to block any malicious requests made to your Cloudfront based on criteria defined in the WAF Web Access Control List (ACL) associated with the CDN distribution. **Default Value:** By default, Cloudfront CDN and WAF are not Associated, If you want to create, First you have to create CDN distribution in Cloudfront, and Web ACL (Access Control List) in WAF and attach ACL with Cloudfront CDN ### **Pre-requisites** - Must have CloudFront Distribution - Create a AWS WAF ACL. ### **Test Plan:** 1\. Log in to the AWS management console. 2\. Navigate to the CloudFront dashboard at [https://console.aws.amazon.com/cloudfront](https://console.aws.amazon.com/cloudfront "https://console.aws.amazon.com/cloudfront"). 3\. On the Distributions page, select the CDN distribution that you want to examine.![](https://support.icompaas.com/assets/kb/19670ed64e168df8.png) 4. Click  on the General button ![](https://support.icompaas.com/assets/kb/e78534b5ca826ecf.png) 5\.  On the Distribution Settings page, verify the AWS WAF Web ACL configuration status. If AWS WAF Web ACL is set to None:![](https://support.icompaas.com/assets/kb/f4337ffa25db735e.png)  6\. The selected CDN distribution is not currently associated with an Access Control List (ACL), therefore          is not integrated with the AWS WAF service for protection against malicious viewers.  7\. Repeat step no. 3-6 for each Cloudfront CDN distribution available in your AWS account. ### **CLI Commands** 1\.  To get to know about the Distribution aws cloudfront get-distribution --id E2ZZAENK18GEUD --query 'Distribution.DistributionConfig.WebACLId' ## **Remediation:** 1\.  Login to the AWS Management Console. 2\.  Navigate to the Web Application Firewall dashboard at [https://console.aws.amazon.com/wafv2/homev2](https://console.aws.amazon.com/wafv2/homev2 "https://console.aws.amazon.com/wafv2/homev2") 3\. In the left navigation panel, Under the AWS WAF section, choose Web ACLs. 4\. Click Create web ACL button from the WAF dashboard top menu to initiate the Access Control List built process. ![](https://support.icompaas.com/assets/kb/071a02c68fd586c3.png)  5\. On the Name ACL page, in the Web ACL name and CloudWatch metric name fields, provide names   for the new WAF web         ACL and the required AWS CloudWatch metric. Click Next to continue the ACL setup process.![](https://support.icompaas.com/assets/kb/9b213c3b962e2802.png)  6\. On the Create Conditions page, choose one of the predefined conditions that you want to use to           allow or block requests         that are forwarded to your CloudFront web distributions.   Click the Create  condition button available within the chosen condition category to configure the     condition access control filters based on your requirements. Once the necessary filters are defined, click Create to instantiate the new condition, Repeat the step to create as many conditions as needed. Click Next to continue the setup.![](https://support.icompaas.com/assets/kb/ac4b06d38c765a22.png) 7\. On the Create rules page, under Add rules to a web ACL, click Create a rule to define the ACL rule         that will reference             one or more conditions, which must be satisfied to activate the rule. In the Create     rule dialogue box, provide names for the         rule and the required CloudWatch metric then add the           necessary conditions. Click Create to instantiate the new rule. ![](https://support.icompaas.com/assets/kb/a8d7ff2f1d038d87.png)  8\. In if a request matches all of the conditions in a rule, take the corresponding action section, and             select the appropriate         action to take for each rule if a request matches the rule conditions. Thee If a request doesn’t match any of the rules, go to the default action section, choose the default action that the ACL must take if a request doesn’t match any of the rules defined, and click Next to continue.  On the Choose AWS resource page, select from the Resource dropdown list the Cloudfront web distributions that you want to associate with this new WAF ACL.![](https://support.icompaas.com/assets/kb/eb541aed4164e0aa.png) 9\. Click the Review and Create button to open the Review and create the page.   ![](https://support.icompaas.com/assets/kb/29ef92d2dc8b07cb.png)    10\. Review the web ACL setting then click Confirm and create to generate the ACL once created the             new ACL will be             listed on the Web ACLs WAF page. On the AWS Cloudfront Distributions page, the       associated distribution status will             change from In Process to Deployed once the configuration                change is deployed through the entire CDN network (it         should take less than 15 minutes). 11\. Navigate to the CloudFront page [https://us-east-1.console.aws.amazon.com/cloudfront](https://us-east-1.console.aws.amazon.com/cloudfront/v3/home?region=us-east-1#/distributions "https://us-east-1.console.aws.amazon.com/cloudfront/v3/home?region=us-east-1#/distributions") 12\. click on Cloudfront Distribution![](https://support.icompaas.com/assets/kb/a4b614a9605490b1.png) 13\. Select the Distribution you want to make changes ![](https://support.icompaas.com/assets/kb/bc0bae227b46465f.png)  14\. Click on the General ![](https://support.icompaas.com/assets/kb/90ac2750c93b90f3.png)  15\. Click on the Edit button in the setting  ![](https://support.icompaas.com/assets/kb/ad51d108004d891e.png)   16\. Click on Choose web ACL ![](https://support.icompaas.com/assets/kb/e8f6329c185b65c3.png)   17\. Click on Save changes![](https://support.icompaas.com/assets/kb/339742351d87a974.png)  **CLI Commands** 1\.  Run the **create-web-ACL** command to create the AWS WAF web Access Control List that will be attached later to the Cloudfront distribution used as a CDN solution for your web application:  aws waf create-web-acl --name --metric-name --default-action Type=BLOCK --change-token 3ub5d8bb-73c6.... 2\.  To update the distribution aws cloudfront update-distribution --id --distribution-config file://distconfig-waf-integration.json --if-match **Backout Plan:** 1\. Open the Amazon CloudFront console at [https://console.aws.amazon.com/cloudfront/home](https://console.aws.amazon.com/cloudfront/home "https://console.aws.amazon.com/cloudfront/home") 2\. Click on Distribution 3\. Click on General  4\. In the Settings page Click on edit 5\. Click on None in the AWS WAF ACL![](https://support.icompaas.com/assets/kb/7a579ac1133862c0.png) 6\. Click on save changes  ### **CLI Commands** 1\. To delete the WAF ACL aws waf delete-web-acl --web-acl-id --change-token **References:**   [https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html](https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html) [https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html](https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html) [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-streaming-distribution.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-streaming-distribution.html) [https://docs.aws.amazon.com/cli/latest/reference/waf/delete-web-acl.html](https://docs.aws.amazon.com/cli/latest/reference/waf/delete-web-acl.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.