This document will provide detailed instructions and a step-by-step process to setup and configure a WAF for AWS using Cloudfront.

Phase 1: Prerequisites

1. Existing CloudFront Distribution: Ensure you have a functioning Amazon CloudFront distribution serving your application or static site.
2. Access: Ensure you have the necessary IAM permissions to modify WAF, CloudFront, and Logging resources.

Phase 2: Creating the Web ACL

1. Open the AWS WAF Console: Navigate to WAF & Shield in the AWS Management Console.
2. Create a Web ACL:
   • Click Create web ACL.
   • Name: Give your Web ACL a descriptive name (e.g., AppName-CloudFront-WAF).
   • Resource type: CRITICAL STEP - You must select Global (CloudFront). If you select Regional, you will not be able to attach it to CloudFront.
3. Associate AWS resources:
   • Click Add AWS resources.
   • Select your CloudFront distribution from the list and click Add.
   • (Note: You can also attach the WAF later directly from the CloudFront console under the "Security" tab of your distribution).

Phase 3: Adding Rules and Rule Groups

1. Under Add rules and rule groups, click Add rules.
2. AWS Managed Rules: It is highly recommended to start here.
   • Select Add managed rule groups.
   • Expand AWS managed rule groups.
   • Common additions include the Core rule set (protects against OWASP Top 10 like SQLi and XSS), Known bad inputs, and Amazon IP reputation list.
3. Custom Rules (Optional): You can create custom rules for specific needs, such as:
   • Rate-based rules: Block IPs that send more than X requests in a 5-minute window (excellent for mitigating DDoS or brute-force attacks).
   • Geo-match rules: Block or allow traffic only from specific countries.
4. Set Default Action: At the bottom, choose the default action for requests that do not match any of your rules. For most web applications, this is set to Allow.
5. Set Rule Priority: AWS evaluates rules from top to bottom. Drag your rules to order them (e.g., Custom IP Allow/Deny lists should usually go at the very top, before Managed Rules).

Phase 4: Configure Logging and Metrics (Enterprise Crucial)

1. Metrics: Enable Amazon CloudWatch metrics so you can monitor blocked and allowed requests.
2. Logging destination: Enable logging. You will need to select an Amazon S3 bucket, a CloudWatch Logs log group, or Amazon Kinesis Data Firehose.
   • NASA Context: In a NASA environment, you likely have strict requirements for where logs must be sent (often a centralized enterprise bucket or a specific Kinesis stream for SIEM ingestion). Consult your project's security plan.

Phase 5: Testing and Deployment

1. Start in "Count" Mode: When adding your rules, set the action of each rule to Count instead of Block. This acts as a "dry run."
2. Monitor Traffic: Let the WAF run in Count mode for a few days. Review the logs to identify any "false positives" (legitimate traffic that would have been blocked).
3. Switch to "Block": Once you have tuned your rules and verified that legitimate users are not being impacted, edit the Web ACL and change the rule actions from Count to Block.