CloudFront distribution without a WAF web ACL

Description

Associating an AWS WAF web ACL with a CloudFront distribution lets it inspect web requests at the edge and control them according to configured rules and actions. A distribution without an associated web ACL does not receive this WAF protection layer.

Association alone does not block every attack. Rule scope and actions matter, and the Count action records requests without blocking them. WAF does not replace application authentication, input validation or vulnerability fixes.

Potential impact

An opportunity to limit malicious requests or abnormal request volumes at the edge may be lost.
An application vulnerability could be exploited without WAF rules that could mitigate the attack.

Remediation

Prepare an AWS WAF web ACL with CLOUDFRONT scope and set distributionConfig.webACLID to its ARN in us-east-1.
Configure managed rules and rate limits appropriate for the service. Use Count mode and logs to assess their effects before enabling the required blocking actions.
Verify that the web ACL is associated with the actual distribution, and test its handling of malicious and legitimate requests.

Examples

These partial distribution examples compare only the web ACL association. Required settings such as certificates and origins are omitted. Replace the example ARN with an actual web ACL ARN for CloudFront.

Before

yaml

apiVersion: cloudfront.aws.crossplane.io/v1alpha1
kind: Distribution
spec:
  forProvider:
    distributionConfig:
      enabled: true
      viewerCertificate:
        minimumProtocolVersion: TLSv1.2_2018

This definition has no WAF web ACL association. Review the required protection together with the application's other security controls.

After