Homepage

CloudFront distribution is not protected by WAF Affecting CloudFront service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
General/ Firewall

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
AWS-Well-ArchitectedCIS-ControlsCSA-CCMISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00026
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

WAF should be deployed on CloudFront distributions to protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

How to fix?

Set the web_acl_id attribute to an existing AWS WAF web ACL ARN.

Example Configuration

resource "aws_cloudfront_distribution" "s3_distribution" {
  web_acl_id = "${aws_waf_web_acl.waf_acl.id}"
  
  origin {
    domain_name = "${aws_s3_bucket.http-monitor-origin.bucket_regional_domain_name}"
    origin_id   = "${aws_s3_bucket.http-monitor-origin.id}"
  }

  enabled = true
  
  restrictions {
    geo_restriction {
      restriction_type = "whitelist"
      locations        = ["US", "CA", "GB", "DE"]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  default_cache_behavior {
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "${aws_s3_bucket.http-monitor-origin.id}"

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }
}