All checks
Medium
CloudFront distributions should have WAF enabled
Confirms that CloudFront distributions are associated with an AWS WAF Classic or WAF web ACL.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Associate a web ACL with the distribution. It has to be a CloudFront-scope web ACL: a Regional one built for a load balancer cannot be attached here. Do not reach for the WAF associate-web-acl call on the way, which AWS documents as covering every resource type except CloudFront distributions. An empty web ACL with a default action of Allow satisfies this check and blocks nothing, so treat the association as the start of the work: put new rules in Count mode and read the sampled requests before switching them to Block.
In the console
CloudFront → Distributions → the distribution → Security → AWS WAF
See which of your accounts this check is failing on.
Book a demo