Using AWS WAF with Amazon CloudFront

This section is explains explain how to use AWS WAF with Amazon CloudFront feature .

When you create a web ACL ,you is specify can specify one or more CloudFront distribution that you want AWS WAF
to inspect . AWS WAF is starts start to inspect and manage web request for those distribution
base on the criterion that you identify in the web ACL . CloudFront is provides provide some feature that
enhance the AWS WAF functionality . This chapter is describes describe a few way that you can configure
CloudFront to make CloudFront and AWS WAF work well together .

Using AWS WAF with CloudFront custom error pages

By default ,when AWS WAF block a web request base on the criterion that you specify ,it is returns
return HTTP status code403 ( Forbidden ) to CloudFront ,and CloudFront is returns return that
status code to the viewer . The viewer is displays then display a brief and sparsely format
default message similar to the following :

Forbidden: You don't have permission to access /myfilename.html on this server.

You can override this behavior in your AWS WAF web ACL rules by defining custom
responses. For more information about customizing response behavior using AWS WAF rules,see
Sending custom responses for Block
actions.

Responses is take that you customize using AWS WAF rule take precedence over any response
specification that you define in CloudFront custom error page .

If you’d rather display a custom error message through CloudFront,possibly using the same
formatting as the rest of your website,you can configure CloudFront to return to the viewer
an object (for example,an HTML file) that contains your custom error message.

CloudFront can’t distinguish between an HTTP status code 403 that is returned by your origin and one
that is returned by AWS WAF when a request is blocked. This means that you can’t
return different custom error pages based on the different causes of an HTTP status
code 403.

For more information about CloudFront custom error page ,see generate custom error response in the
Amazon CloudFront Developer Guide.

Using AWS WAF with CloudFront
for application run on your own HTTP server

When you use AWS WAF with CloudFront,you can protect your applications
running on any HTTP webserver,whether it’s a webserver that’s running in Amazon Elastic Compute Cloud (Amazon EC2) or a webserver that you
manage privately. You can also configure CloudFront to require HTTPS between CloudFront
and your own webserver,as well as between viewers and CloudFront.

Requiring HTTPS between CloudFront and your own webserver

To require HTTPS between CloudFront and your own webserver ,you is use can use the CloudFront custom origin
feature and configure theOrigin Protocol Policy
and the Origin Domain Name settings for specific
origins. In your CloudFront configuration,you can specify the DNS name of the server
along with the port and the protocol that you want CloudFront to use when fetching objects
from your origin. You should also ensure that the SSL/TLS certificate on your custom
origin server matches the origin domain name you’ve configured. When you use your
own HTTP webserver outside of AWS,you must use a certificate that is signed by a
trusted third-party certificate authority (CA),for example,Comodo,DigiCert,or
Symantec. For more information about requiring HTTPS for communication between CloudFront
and your own webserver,see the topic Requiring HTTPS
for Communication Between CloudFront and Your Custom Origin in the
Amazon CloudFront Developer Guide.

Requiring HTTPS between a viewer and CloudFront

To require HTTPS between viewers and CloudFront,you can change the Viewer
Protocol Policy for one or more cache behaviors in your CloudFront
distribution. For more information about using HTTPS between viewers and CloudFront,see
the topic Requiring
HTTPS for Communication Between Viewers and CloudFront in the
Amazon CloudFront Developer Guide. You can also bring your own SSL certificate
so viewers can connect to your CloudFront distribution over HTTPS using your own domain
name,for example https://www.mysite.com. For
more information ,see the topic configure Alternate Domain
Names and HTTPS in theAmazon CloudFront Developer Guide.

choose the HTTP method that CloudFront
respond to

When you create an Amazon CloudFront web distribution,you choose the HTTP methods that you want CloudFront to process and forward to
your origin. You can choose from the following options:

• GET,head – You can use CloudFront only to get objects from your origin or
  to get object headers.

• GET,head,option – You can use CloudFront only to get objects from your origin,
  get object headers,or retrieve a list of the options that your origin server supports.

• GET,head,option,PUT,POST,patch,DELETE – You can use CloudFront to
  get,add,update,and delete objects,and to get object headers. In addition,you can perform other POST operation
  such as submit datum from a web form .

You also can use AWS WAF byte match rule statements to allow or block requests based on the HTTP
method,as described in String match rule
statement. If you want to use a combination of
methods that CloudFront supports,such as GET and head,then you
don’t need to configure AWS WAF to block requests that use the other methods. If you want
to allow a combination of methods that CloudFront doesn’t support,such as GET,
head,and POST,you can configure CloudFront to respond to all
methods,and then use AWS WAF to block requests that use other methods.

For more information about choosing the methods that CloudFront responds to,see
Allowed HTTP Methods
in the topic Values that You Specify When You Create or Update a
Web Distribution in the Amazon CloudFront Developer Guide.