This document will provide detailed instructions and a step-by-step process to setup and configure a WAF for AWS using Cloudfront.

Phase 1: Prerequisites

  1. Existing CloudFront Distribution: Ensure you have a functioning Amazon CloudFront distribution serving your application or static site.
  2. Access: Ensure you have the necessary IAM permissions to modify WAF, CloudFront, and Logging resources.

Phase 2: Creating the Web ACL

  1. Open the AWS WAF Console: Navigate to WAF & Shield in the AWS Management Console.
  2. Create a Web ACL:
    • Click Create web ACL.
    • Name: Give your Web ACL a descriptive name (e.g., AppName-CloudFront-WAF).
    • Resource type: CRITICAL STEP - You must select Global (CloudFront). If you select Regional, you will not be able to attach it to CloudFront.
  3. Associate AWS resources:
    • Click Add AWS resources.
    • Select your CloudFront distribution from the list and click Add.
    • (Note: You can also attach the WAF later directly from the CloudFront console under the "Security" tab of your distribution).

Phase 3: Adding Rules and Rule Groups

  1. Under Add rules and rule groups, click Add rules.
  2. AWS Managed Rules: It is highly recommended to start here.
    • Select Add managed rule groups.
    • Expand AWS managed rule groups.
    • Common additions include the Core rule set (protects against OWASP Top 10 like SQLi and XSS), Known bad inputs, and Amazon IP reputation list.
  3. Custom Rules (Optional): You can create custom rules for specific needs, such as:
    • Rate-based rules: Block IPs that send more than X requests in a 5-minute window (excellent for mitigating DDoS or brute-force attacks).
    • Geo-match rules: Block or allow traffic only from specific countries.
  4. Set Default Action: At the bottom, choose the default action for requests that do not match any of your rules. For most web applications, this is set to Allow.
  5. Set Rule Priority: AWS evaluates rules from top to bottom. Drag your rules to order them (e.g., Custom IP Allow/Deny lists should usually go at the very top, before Managed Rules).

Phase 4: Configure Logging and Metrics (Enterprise Crucial)

  1. Metrics: Enable Amazon CloudWatch metrics so you can monitor blocked and allowed requests.
  2. Logging destination: Enable logging. You will need to select an Amazon S3 bucket, a CloudWatch Logs log group, or Amazon Kinesis Data Firehose.
    • NASA Context: In a NASA environment, you likely have strict requirements for where logs must be sent (often a centralized enterprise bucket or a specific Kinesis stream for SIEM ingestion). Consult your project's security plan.

Phase 5: Testing and Deployment

  1. Start in "Count" Mode: When adding your rules, set the action of each rule to Count instead of Block. This acts as a "dry run."
  2. Monitor Traffic: Let the WAF run in Count mode for a few days. Review the logs to identify any "false positives" (legitimate traffic that would have been blocked).
  3. Switch to "Block": Once you have tuned your rules and verified that legitimate users are not being impacted, edit the Web ACL and change the rule actions from Count to Block.


  • No labels