How do I configure AWS WAF IP set rules for an Application Load Balancer origin behind CloudFront?

Short description

When CloudFront forwards requests to an Application Load Balancer origin, AWS WAF evaluates the CloudFront edge node IP address as the source IP address instead of the original client IP address. As a result, IP set allow or deny rules that target specific client IP addresses don't match. A blanket deny rule that blocks all IP addresses not in your allowlist also blocks legitimate CloudFront traffic.

Resolution

To configure AWS WAF IP set rules for an Application Load Balancer behind CloudFront, choose the approach that matches your situation:

• To allow all CloudFront traffic through a default-deny web access control list (web ACL), see Allow CloudFront IP address ranges in your Application Load Balancer AWS WAF IP set rules.
• To restrict your Application Load Balancer to accept traffic only from your specific CloudFront distribution, see Restrict the Application Load Balancer to accept only your CloudFront distribution traffic.
• To allow or block specific end-user IP addresses at the Application Load Balancer, see Inspect real client IP addresses at the Application Load Balancer with the X-Forwarded-For header.

Allow CloudFront IP address ranges in your Application Load Balancer AWS WAF IP set rules

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, verify that you're using the most recent AWS CLI version.

This approach allows traffic from any CloudFront distribution, not just yours. Another CloudFront distribution could also forward traffic to your Application Load Balancer. Combine this with custom header verification for stronger protection.

If your Application Load Balancer AWS WAF has a default-deny posture that blocks all traffic except allowed IP addresses, then you must allow the CloudFront IP ranges. Otherwise, AWS WAF blocks traffic forwarded from CloudFront.

To create an IP set with CloudFront CIDR blocks, run the following create-ip-set AWS CLI command:

`aws wafv2 create-ip-set \     --name CloudFrontIPs \     --scope REGIONAL \     --ip-address-version IPV4 \     --addresses "[IP_ADDRESS]" "[IP_ADDRESS]" \     --region us-east-1`

Note: Replace the example CIDR blocks with the current CloudFront CIDR blocks from the AWS IP address ranges JSON file. Filter for entries where the service value equals CLOUDFRONT. Replace us-east-1 with your AWS Region.

Then, create an allow rule in your Application Load Balancer web ACL that references the IP set.

Restrict the Application Load Balancer to accept only your CloudFront distribution traffic

To configure CloudFront to send a custom header, complete the following steps:

1. Open the Amazon CloudFront console.
2. Select your distribution, and then choose Origins.
3. Select your Application Load Balancer origin, and then choose Edit.
4. Under Add custom header, take the following actions to add a header:
   For Header name, enter X-Origin-Verify
   For Value, enter a secret string. For example, enter a UUID.
5. Choose Save changes.

Then, create a rule in your Application Load Balancer web ACL that blocks requests so that the X-Origin-Verify header doesn't match your secret value.

To restrict the ALB security group to allow inbound traffic only from CloudFront IP addresses, complete the following steps:

1. Open the Amazon Virtual Private Cloud (Amazon VPC) console.
2. In the navigation pane, choose Security Groups.
3. Select the security group attached to your Application Load Balancer.
4. Edit the inbound rules to allow HTTP/HTTPS only from the AWS managed prefix list com.amazonaws.global.cloudfront.origin-facing.
   Note: The managed prefix list restricts network-level access to CloudFront IP addresses. The AWS WAF custom header rule provides application-level verification that the traffic came from your specific distribution. Use both together for the strongest origin protection.

Inspect real client IP addresses at the Application Load Balancer with the X-Forwarded-For header

If you need to allow or block specific end-user IP addresses at the Application Load Balancer AWS WAF layer, then configure your IP set rules to inspect the X-Forwarded-For header. Note that the source IP address at the Application Load Balancer is a CloudFront edge node IP address, not the client IP address.

Note: The HTTP X-Forwarded-For (XFF) header is a comma-separated list of IP addresses. It represents the path a web request has taken through proxies and load balancers. When CloudFront forwards a request to an ALB, it appends the client IP address to this header. The first entry is the original client IP address.

Configure ForwardedIPConfig in your IP set rule

The following JSON example shows an IP set reference statement with ForwardedIPConfig in an AWS WAF web ACL rule:

{
  "IPSetReferenceStatement": {
    "ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/my-ipset/abcd1234",
    "IPSetForwardedIPConfig": {
      "HeaderName": "X-Forwarded-For",
      "FallbackBehavior": "MATCH",
      "Position": "FIRST"
    }
  }
}

Note: In the preceding JSON, customize the following values: For HeaderName, enter the header that contains client IP addresses. Use X-Forwarded-For for CloudFront origins. For strong>Position, enter FIRST to inspect the original client IP address, or LAST to inspect the most recent proxy IP address. For FallbackBehavior, enter MATCH if you want AWS WAF to treat the request as matching the rule when the header is absent or malformed. Enter NO_MATCH if you want AWS WAF to treat the request as not matching.

Important: XFF headers can be spoofed. Combine XFF-based rules with custom header verification or security group restrictions for reliable protection.

Configure rate-based rules with ForwardedIPConfig

The following JSON example shows a rate-based rule statement with ForwardedIPConfig in an AWS WAF web ACL rule:

{
  "RateBasedStatement": {
    "Limit": 1000,
    "EvaluationWindowSec": 300,
    "AggregateKeyType": "FORWARDED_IP",
    "ForwardedIPConfig": {
      "HeaderName": "X-Forwarded-For",
      "FallbackBehavior": "MATCH"
    }
  }
}

Note: Unlike IP set reference statements, rate-based rules with ForwardedIPConfig don't support a configurable Position parameter. Rate-based rules always use the first IP address in the X-Forwarded-For header for aggregation.

Use the recommended combined approach

For the strongest protection, it's a best practice combine the following methods:

• Restrict the Application Load Balancer security group to the CloudFront managed prefix list com.amazonaws.global.cloudfront.origin-facing to block traffic that doesn't originate from CloudFront at the network level.
• Require custom origin header verification in your Application Load Balancer AWS WAF rules to confirm that traffic comes from your specific CloudFront distribution.
• Configure client-IP rules with XFF inspection for any IP set allow and block rules that target end-user IP addresses. Set Position to FIRST to aggregate by the original client IP address. Set FallbackBehavior to MATCH to count requests toward the rate limit when the header is absent, or NO_MATCH to exclude those requests from the rate count.
• Consider CloudFront VPC origins for secure access to private Application Load Balancers. VPC origins allow CloudFront to connect directly to Application Load Balancers in private subnets without public internet access to prevent public traffic to the Application Load Balancer. It also eliminates the risk of unauthorized CloudFront distributions sending traffic to your Application Load Balancer.
• Place broad IP address rules on CloudFront-associated AWS WAF web ACLs instead of Application Load Balancer web ACLs when possible. Because CloudFront is the first point of contact, the source IP address in a CloudFront-associated web ACL is the actual client IP address. You don't need to configure X-Forwarded-For inspection for these rules.

Related information

IP set match rule statement

Using forwarded IP addresses in AWS WAF

Restrict access to Application Load Balancers

Restrict access with VPC origins

IPSet