# Ensure CloudFront Distributions Are Using AWS WAF

- Source: https://support.icompaas.com/support/solutions/articles/62000233507-ensure-cloudfront-distributions-are-using-aws-waf
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

 Level 2

#### Description

AWS WAF is a web application firewall that helps protect your web applications and APIs from common web exploits and vulnerabilities. By using AWS WAF with CloudFront distributions, you can block malicious requests before they reach your servers, enhancing the security of your web applications.

#### Rationale

-   Enhanced Security: Protects against common web exploits and vulnerabilities.
    
-   Improved Performance: Blocks malicious requests before they reach your servers, reducing load and improving performance.
    
-   Compliance: Ensures adherence to security best practices and regulatory requirements.
    

#### Impact

Pros:

-   Enhances security by blocking malicious requests.
    
-   Reduces load on origin servers, improving performance.
    
-   Ensures compliance with security standards.
    

Cons:

-   Requires additional configuration and management of WAF rules.
    
-   Potential temporary disruption during the setup process.
    

#### Default Value

By default, AWS WAF is not enabled for CloudFront distributions. It must be explicitly configured and associated with the distribution.

#### Pre-Requisite

IAM Permissions:

-   cloudfront:GetDistribution
    
-   cloudfront:UpdateDistribution
    
-   waf:GetWebACL
    
-   waf:AssociateWebACL
    
-   AWS CLI installed and configured.
    

#### Remediation

#### Test Plan: 

Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard.
    
3.  Click on the Distributions tab in the top left navigation menu.
    
4.  Select the Distribution you want to audit.
    
5.  Click on the General tab in the top menu.
    
6.  Check if AWS WAF is enabled and associated with the distribution.
    

Using AWS CLI:

Check WAF Status:

aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.WebACLId'

#### Implementation Steps: 

Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard.  
    ![](https://support.icompaas.com/assets/kb/8d0f512439b80131.png)
    
3.  Click on the Distributions tab in the top left navigation menu.
    
4.  Select the Distribution you want to modify.  
    ![](https://support.icompaas.com/assets/kb/81787cf5d0bbf2e7.png)
    
5.  Click on the General tab in the top menu.
    
6.  Click Edit to modify the distribution settings.  
    ![](https://support.icompaas.com/assets/kb/8c7109f04fbf87fa.png)
    
7.  Enable AWS WAF and associate a Web ACL (Web Access Control List).
    
8.  Click Save changes to save the changes.
    

Using AWS CLI:

Associate a Web ACL with the CloudFront distribution:

aws cloudfront update-distribution --id <distribution-id> --distribution-config file://distconfig-waf.json

  

#### Backout Plan

#### Using AWS Console:

1.  Navigate to the CloudFront Dashboard.
    
2.  Select the Distribution.
    
3.  Click Edit Attributes.
    
4.  Revert to the previous configuration by disassociating the Web ACL.
    
5.  Click Save changes to save the changes.
    

Using AWS CLI:

aws cloudfront update-distribution --id <distribution-id> --distribution-config file://distconfig-original.json

  

#### References

-   [AWS WAF Documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html)
    
-   [Using AWS WAF with Amazon CloudFront](https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html)
    
-   [Turn on AWS WAF for CloudFront distributions](https://repost.aws/knowledge-center/waf-cloudfront-distribution)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.