AWS CloudFront web distribution with AWS Web Application Firewall (AWS WAF) service disabled misconf

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_68
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	6cec2122-f991-4109-99e6-a49f33fc9b9e

Impact

AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules. We recommend that you enable AWS WAF for AWS Cloudfront and that you create rules that block common attack patterns, such as SQL injection, cross-site scripting, and rules that filter out specific traffic patterns that you have defined. With AWS Cloudfront -- WAF integration enabled, you will be able to block any malicious requests made to your Cloudfront Content Delivery Network based on the criteria defined in the WAF Web Access Control List (ACL) associated with the CDN distribution.

How to Fix

Resource: AWS::CloudFront::Distribution

• Arguments: Properties.DistributionConfig.WebACLId [source,go]

---

Type: 'AWS::CloudFront::Distribution' Properties: ... DistributionConfig: ... WebACLId: arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/12345