AWS Security Academy · Lesson

Attaching WAF to CloudFront and ALB

Place WAF in front of the right edge or load balancer service.

Attaching WAF to CloudFront and ALB is a free AWS Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

WAF Needs a Host

WAF is not a standalone appliance; it must be associated with a resource that forwards requests to it. The supported integrations are CloudFront, Application Load Balancer (ALB), API Gateway, AppSync, Cognito user pools, and App Runner. Where you attach WAF determines where inspection happens.

CloudFront at the Edge

Attaching WAF to a CloudFront distribution inspects requests at AWS edge locations before they travel to your origin. This blocks attacks closest to the user, reduces backend load, and works globally. It is ideal for public websites and content delivery where edge filtering adds the most value.

ALB at the Region

Attaching WAF to an Application Load Balancer inspects requests as they reach your regional load balancer. This suits internal applications, APIs behind an ALB, or cases where traffic does not flow through CloudFront. The web ACL must use the REGIONAL scope in the ALB Region.

Scope Must Match

Recall that a web ACL is CLOUDFRONT scope (global, us-east-1) or REGIONAL scope. You cannot attach a regional web ACL to CloudFront or a CloudFront web ACL to an ALB. Choosing the wrong scope is a common deployment error the exam highlights.

Defense at Multiple Layers

For maximum protection you can place CloudFront in front of an ALB and attach WAF at both: a CloudFront web ACL for global edge filtering and a regional web ACL on the ALB as a backstop. This guards against requests that bypass CloudFront and reach the ALB directly.

Protecting the Origin

If attackers can reach your ALB directly, they bypass CloudFront and its WAF. Mitigate this by restricting the ALB security group to CloudFront IP ranges or using a custom secret header that CloudFront adds and the ALB or WAF verifies, ensuring traffic truly came through the edge.

# Origin protection pattern
CloudFront adds header: X-Origin-Verify: <secret>
WAF on ALB blocks requests missing that header

API Gateway and AppSync

WAF also attaches to API Gateway REST APIs and AppSync GraphQL APIs, both regional. This protects API-driven backends from injection and abuse without a separate load balancer. For serverless APIs this is the natural enforcement point.

Cognito Protection

WAF can attach to Cognito user pools to defend authentication endpoints against credential stuffing and bot-driven sign-up abuse, pairing well with the Account Takeover Prevention managed group. This protects identity flows that are frequent targets. Edge inspection on CloudFront also adds negligible latency and blocks attacks earlier than waiting for a regional ALB.

One Resource, One Web ACL

A resource can be associated with only one web ACL at a time, but one web ACL can protect many resources. To apply different policies, you create separate web ACLs. Centralizing shared rules in managed or custom rule groups keeps multiple web ACLs consistent.

Choosing the Attachment Point

Decide based on traffic flow: public, global content favors CloudFront; regional or internal apps favor ALB; serverless APIs favor API Gateway or AppSync. When in doubt, attach at the edge and add origin protection so attackers cannot route around it.

Tying It Together

WAF protection is only as good as its placement. Match the scope to the resource, prefer edge attachment for public apps, layer ALB WAF as a backstop, and lock the origin to CloudFront. These placement choices recur throughout SCS-C02 network-protection scenarios.

Quick Check

Apply WAF attachment knowledge.

Recap

WAF must be attached to a resource: CloudFront, ALB, API Gateway, AppSync, Cognito, or App Runner. CloudFront inspects globally at the edge; ALB and the rest inspect regionally and require a REGIONAL-scope web ACL. Layer WAF at both edge and ALB, and protect the origin with a secret header or CloudFront IP ranges so attackers cannot bypass edge filtering. One resource maps to one web ACL.

Frequently asked questions

Is the “Attaching WAF to CloudFront and ALB” lesson free?

Yes — the full text of “Attaching WAF to CloudFront and ALB” is free to read here on the web, and the AWS Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Attaching WAF to CloudFront and ALB”?

Place WAF in front of the right edge or load balancer service. You practise AWS Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AWS Security Academy?

No prior experience is required. AWS Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Attaching WAF to CloudFront and ALB” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AWS Security Academy lesson?

Yes. Every AWS Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to AWS Security Academy