How to add WAF to protect an Amplify hosted website?


I have a website developed by NextJS and hosted by AWS Amplify. How to integrate WAF to protect the site such as block IP originated from Singapore?

  1. I have looked into CloudFront distribution (generated by Amplify hosting) and add a WAF ACL rule, but it did not work well. I block SG (Signapore) but it block from VN as well. Can't figure out why that?

  2. What is the difference between WAF ACL Geo rule and CLoudFront Geo Restriction?

  "Name": "GeoRestriction",
  "Priority": 0,
  "Action": {
    "Block": {}
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "GeoRestriction"
  "Statement": {
    "GeoMatchStatement": {
      "CountryCodes": [
posta 2 anni fa6036 visualizzazioni
3 Risposte

I understand you are trying to integrate WAF to protect your site. As to why the WAF ACL rule is not working as intended, there is likely a configuration issue. To troubleshoot the issue quickly, I suggest opening a case with AWS Support:

The difference between WAF geographic match rule statements and CloudFront geographic restrictions is that you can use the former with other AWS WAF statements to build sophisticated filtering. For example, if you wanted to allow certain traffic from certain IPs in Singapore, but deny other traffic from Singapore, the WAF rule would be useful.

Considering your use case, creating a geographic restriction on CloudFront would be the most convenient solution. You can block all traffic from Singapore with 99.8% accuracy. In order to do so, please follow these steps:

  1. Sign in to the AWS Management Console and open the CloudFront console at
  2. Choose the distribution that you want to update.
  3. Choose Geographic restrictions.
  4. Choose Edit.
  5. Select Allow list to create a list of allowed countries, or Block list to create a list of blocked countries.
  6. Add the desired countries to the list, then choose Save changes.

For more on how AWS WAF works with Amazon CloudFront features:

con risposta 2 anni fa
verificato 2 anni fa

Unfortunately, at this point in time the Amplify Console officially does not support AWS WAF integration with the generated CloudFront URL. The Amplify CloudFront URL does come with AWS Shield standard.

The Amplify service team have identified this as a known feature request. Please refer to this open GitHub issue which is pertaining to the feature request and it can be tracked here:

There's a way to setup WAF for your custom domain creating a documentation but the underlying domain is still technically live, so it's security by obscurity in essence.

profile pictureAWS
con risposta un anno fa

To enable AWS WAF for web applications hosted by AWS Amplify please refer to the following documentation -

con risposta 9 mesi fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande