Description

Ensure that every Amazon CloudFront distribution is associated with an AWS WAF web ACL. The web ACL inspects HTTP and HTTPS requests at the CloudFront edge locations and allows, blocks or counts them according to its rules before they reach the origin.

Rationale

Without AWS WAF, Internet-facing distributions are exposed to application-layer attacks such as SQL injection, cross-site scripting, bot abuse and request floods. These attacks can lead to data theft, unauthorized actions and overloaded origins, and can also increase data transfer and compute costs. Associating a web ACL that uses managed rule groups, rate limits and, where needed, IP, geographic and bot controls adds a layer of defense in front of the application.

Impact

  • Filters malicious requests before they reach the origin

  • Adds protection against common web exploits and request floods

  • AWS WAF is charged per web ACL, per rule and per request

  • Rules that are too strict can block legitimate users, so new rules should be tested in Count mode first

Default Value

A new CloudFront distribution is not associated with an AWS WAF web ACL unless one is selected when it is created.

Pre-Requisites

  • IAM permissions: cloudfront:ListDistributions, cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, wafv2:ListWebACLs, wafv2:CreateWebACL and wafv2:GetWebACL

  • An AWS WAF web ACL with CloudFront (global) scope, or agreement on the rules to include in a new one

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudFront console and select Distributions.

  3. Select a distribution and, on the General tab, review the Settings section.

  4. Check whether an AWS WAF web ACL is associated with the distribution.

  5. Repeat for each distribution.

  6. If any distribution has no web ACL, follow the implementation steps.

CLI:

Show the web ACL associated with each distribution:

aws cloudfront list-distributions --query "DistributionList.Items[].[Id,DomainName,WebACLId]" --output table

A distribution fails if WebACLId is empty.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. If no suitable web ACL exists, open the AWS WAF console, select Web ACLs, choose the Global (CloudFront) scope and create a web ACL with the required rules (for example, AWS managed rule groups and a rate-based rule).

  3. Open the Amazon CloudFront console and select Distributions.

  4. Select the distribution and, on the General tab, choose Edit in the Settings section.

  5. Under the AWS WAF web ACL setting, select the web ACL.

  6. Choose Save changes and wait until the distribution finishes deploying.

  7. Repeat for each affected distribution.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudFront console and select the distribution.

  3. On the General tab, choose Edit in the Settings section.

  4. Remove the AWS WAF web ACL association, or select the previously used web ACL.

  5. Choose Save changes.

Note: removing the web ACL leaves the distribution without application-layer filtering. If legitimate traffic is blocked, consider switching the affected rule to Count mode instead of removing the web ACL.

Reference