How do I use AWS WAF to protect my Amazon EC2 instance?

Resolution

You can't directly associate AWS WAF with an Amazon EC2 instance. Instead, register your instance as a target for your Application Load Balancer. Then, associate your web access control list (web ACL) in AWS WAF with the Application Load Balancer.

Create a target group and add the Amazon EC2 instance as its target

Complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, under Load Balancing, choose Target Groups.
3. Choose Create target group.
4. Under Basic Configuration, set the following parameters:
   For Choose a target type, select Instance to specify targets by instance ID.
   For Target group name, enter a name for the target group.
   Modify the Port and Protocol as needed.
   For VPC, select the virtual private cloud (VPC) where your instance is located.
   For Protocol version, select HTTP1, HTTP2, or gRPC based on your request protocol.
   For health checks, see Health check settings.
5. Choose Next.
6. For Register targets, select your instances, and then enter your ports.
7. Choose Include as pending below.
8. Choose Create target group.

Configure an Application Load Balancer and listener

For instructions, see Step 3: Configure a load balancer and a listener.

Associate your web ACL with the Application Load Balancer

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, choose Web ACLs.
3. For Region, select the AWS Region where you created your web ACL.
   Note: If your web ACL is set up for Amazon CloudFront, then select Global.
4. Select your web ACL.
5. Under Associated AWS resources, choose Add AWS resources.
6. Select your Application Load Balancer.
7. Choose Add.