CloudFront distribution uses an AWS WAF web ACL

Check ID: cloudfront_distributions_using_waf
Provider: AWS
Service: cloudfront
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are assessed for an associated AWS WAF web ACL that inspects and filters HTTP/S requests at the edge. The finding highlights distributions without this web ACL association.

Risk

Absent WAF on Internet-facing distributions exposes apps to layer-7 threats: SQLi/XSS and bot abuse can cause data exfiltration (confidentiality), unauthorized actions (integrity), and request floods that overload origins (availability). It may also raise egress and compute costs.

Recommendation

Associate each distribution with an AWS WAF web ACL and apply defense-in-depth:

Use managed rule groups and rate limits
Add IP/geo and bot controls as needed
Enable logging, test new rules in count mode, and tune
Monitor metrics and update rules

Align controls with least privilege for requests.

Remediation

Terraform
Native IaC
Dashboard steps

# Add this to the existing CloudFront distribution resource
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  web_acl_id = "<example_web_acl_arn>"  # CRITICAL: Associates the WAFv2 Web ACL (ARN) to the distribution to PASS the check
}

# CloudFormation: associate an AWS WAFv2 Web ACL with a CloudFront distribution
Resources:
  <example_distribution>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: origin1
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: origin1
          ViewerProtocolPolicy: redirect-to-https
          ForwardedValues:
            QueryString: false
        WebACLId: <example_web_acl_arn>  # CRITICAL: Associates the WAFv2 Web ACL (ARN) to this distribution
        # This makes the distribution PASS by enabling WAF protection

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_using_waf. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront does not use deprecated SSL/TLS protocols CloudTrail trail S3 bucket has MFA delete enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires