All checks
Medium
CloudFront distributions should have WAF enabled
Checks that the CloudFront distribution is associated with an AWS WAF or AWS WAF Classic web ACL, which filters malicious requests before they reach the origin. Only the association is read, so an empty web ACL whose default action is Allow passes and blocks nothing.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: A blocking rule drops every request it matches, legitimate ones included, so start new rules in count mode (monitor mode here) and read the sampled requests first.
In the console
CloudFront → Distributions → the distribution → Security → Web Application Firewall (WAF) → Edit
- Enable security protections
- Use existing WAF configuration, or the protections CloudFront sets up for you
- Web ACL
- A web ACL for CloudFront (global scope); a Regional one, such as a load balancer's, cannot be attached
See which of your accounts this check is failing on.
Book a live scan