Back to Checks
aws

CloudFront distribution uses an AWS WAF web ACL

cloudfront_distributions_using_waf
Service: cloudfrontSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are assessed for an associated AWS WAF web ACL that inspects and filters HTTP/S requests at the edge.

The finding highlights distributions without this web ACL association.

Prowler logoProwlerprowler-provider-aws

Risk

Absent WAF on Internet-facing distributions exposes apps to layer-7 threats: SQLi/XSS and bot abuse can cause data exfiltration (confidentiality), unauthorized actions (integrity), and request floods that overload origins (availability). It may also raise egress and compute costs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_using_waf

Recommendation

Associate each distribution with an AWS WAF web ACL and apply defense-in-depth:

  • Use managed rule groups and rate limits
  • Add IP/geo and bot controls as needed
  • Enable logging, test new rules in count mode, and tune
  • Monitor metrics and update rules

Align controls with least privilege for requests.

Remediation

Terraform

# Add this to the existing CloudFront distribution resource
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  web_acl_id = "<example_web_acl_arn>"  # CRITICAL: Associates the WAFv2 Web ACL (ARN) to the distribution to PASS the check
}

NativeIaC

# CloudFormation: associate an AWS WAFv2 Web ACL with a CloudFront distribution
Resources:
  <example_distribution>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: origin1
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: origin1
          ViewerProtocolPolicy: redirect-to-https
          ForwardedValues:
            QueryString: false
        WebACLId: <example_web_acl_arn>  # CRITICAL: Associates the WAFv2 Web ACL (ARN) to this distribution
        # This makes the distribution PASS by enabling WAF protection

Other

1In the AWS Console, go to CloudFront > Distributions and select your distribution
2Click Edit (General/Settings)
3Set AWS WAF Web ACL to your Web ACL (scope: Global/CloudFront)
4Click Save/Yes, Edit and wait for Deployment to complete
5If no Web ACL exists: go to WAF & Shield > Web ACLs (scope: CloudFront), Create web ACL, then repeat steps 1-4 to associate it

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_using_waf(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            if distribution.web_acl_id:
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} is using AWS WAF web ACL {distribution.web_acl_id}."
            else:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} is not using AWS WAF web ACL."
            findings.append(report)

        return findings

References