Description

Ensure that Amazon CloudFront distributions have an AWS WAF web ACL associated, so that incoming requests are inspected and filtered against defined rules (such as managed rule groups for common exploits, rate-based rules, and IP reputation lists) before reaching the origin.

Rationale

Without a WAF web ACL, CloudFront forwards all requests that pass basic distribution configuration directly toward the origin, leaving the application exposed to common web exploits such as SQL injection, cross-site scripting, and volumetric or credential-stuffing style abuse, which the origin application must then defend against on its own. Associating a WAF web ACL provides an additional layer of defense at the edge, filtering malicious requests before they reach backend infrastructure.

Impact

  • Provides an additional layer of defense against common web exploits and malicious traffic patterns

  • Reduces the load on origin infrastructure from filtered malicious or abusive requests

  • Requires ongoing tuning of WAF rules to balance security with false positives affecting legitimate traffic

Default Value

No WAF web ACL is associated with a newly created CloudFront distribution by default.

Pre-Requisites

  • An AWS WAF web ACL created in the CLOUDFRONT scope (in us-east-1)

  • IAM permissions to update CloudFront distributions (cloudfront:UpdateDistribution) and associate a web ACL (wafv2:AssociateWebACL)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudFront and select the distribution to review.

  3. Open the General tab (or Security section) and review the AWS WAF Web ACL field.

  4. Verify that a web ACL is associated with the distribution.

  5. If no web ACL is associated, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS WAF & Shield and create a web ACL in the CloudFront (global) scope, adding appropriate managed rule groups and/or custom rules.

  3. Navigate to Amazon CloudFront and select the distribution to update.

  4. Select Edit on the distribution settings (Security section) and select the web ACL created above under AWS WAF Web ACL.

  5. Save the changes and wait for the distribution to finish deploying.

  6. Monitor the WAF's sampled requests and metrics after deployment to confirm legitimate traffic is not being blocked unexpectedly.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudFront and select the affected distribution.

  3. Select Edit on the distribution settings and set AWS WAF Web ACL to None.

  4. Save the changes and wait for the distribution to finish deploying.

Reference