# Ensure CloudFront distribution uses an AWS WAF web ACL

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292235770398-ensure-cloudfront-distribution-uses-an-aws-waf-web-acl
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon CloudFront distribution is associated with an AWS WAF web ACL. The web ACL inspects HTTP and HTTPS requests at the CloudFront edge locations and allows, blocks or counts them according to its rules before they reach the origin.

**Rationale**

Without AWS WAF, Internet-facing distributions are exposed to application-layer attacks such as SQL injection, cross-site scripting, bot abuse and request floods. These attacks can lead to data theft, unauthorized actions and overloaded origins, and can also increase data transfer and compute costs. Associating a web ACL that uses managed rule groups, rate limits and, where needed, IP, geographic and bot controls adds a layer of defense in front of the application.

**Impact**

-   Filters malicious requests before they reach the origin
    
-   Adds protection against common web exploits and request floods
    
-   AWS WAF is charged per web ACL, per rule and per request
    
-   Rules that are too strict can block legitimate users, so new rules should be tested in **Count** mode first
    

**Default Value**

A new CloudFront distribution is not associated with an AWS WAF web ACL unless one is selected when it is created.

**Pre-Requisites**

-   IAM permissions: cloudfront:ListDistributions, cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, wafv2:ListWebACLs, wafv2:CreateWebACL and wafv2:GetWebACL
    
-   An AWS WAF web ACL with **CloudFront** (global) scope, or agreement on the rules to include in a new one
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon CloudFront console and select **Distributions**.
    
3.  Select a distribution and, on the **General** tab, review the **Settings** section.
    
4.  Check whether an AWS WAF web ACL is associated with the distribution.
    
5.  Repeat for each distribution.
    
6.  If any distribution has no web ACL, follow the implementation steps.
    

**CLI:**

Show the web ACL associated with each distribution:

aws cloudfront list-distributions --query "DistributionList.Items\[\].\[Id,DomainName,WebACLId\]" --output table

A distribution fails if WebACLId is empty.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  If no suitable web ACL exists, open the AWS WAF console, select **Web ACLs**, choose the **Global (CloudFront)** scope and create a web ACL with the required rules (for example, AWS managed rule groups and a rate-based rule).
    
3.  Open the Amazon CloudFront console and select **Distributions**.
    
4.  Select the distribution and, on the **General** tab, choose **Edit** in the **Settings** section.
    
5.  Under the AWS WAF web ACL setting, select the web ACL.
    
6.  Choose **Save changes** and wait until the distribution finishes deploying.
    
7.  Repeat for each affected distribution.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon CloudFront console and select the distribution.
    
3.  On the **General** tab, choose **Edit** in the **Settings** section.
    
4.  Remove the AWS WAF web ACL association, or select the previously used web ACL.
    
5.  Choose **Save changes**.
    

Note: removing the web ACL leaves the distribution without application-layer filtering. If legitimate traffic is blocked, consider switching the affected rule to **Count** mode instead of removing the web ACL.

**Reference**

-   [https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html](https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html)
    
-   [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/list-distributions.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.