How to add WAF to protect an Amplify hosted website?


I have a website developed by NextJS and hosted by AWS Amplify. How to integrate WAF to protect the site such as block IP originated from Singapore?

  1. I have looked into CloudFront distribution (generated by Amplify hosting) and add a WAF ACL rule, but it did not work well. I block SG (Signapore) but it block from VN as well. Can't figure out why that?

  2. What is the difference between WAF ACL Geo rule and CLoudFront Geo Restriction?

  "Name": "GeoRestriction",
  "Priority": 0,
  "Action": {
    "Block": {}
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "GeoRestriction"
  "Statement": {
    "GeoMatchStatement": {
      "CountryCodes": [
질문됨 2년 전6034회 조회
3개 답변

I understand you are trying to integrate WAF to protect your site. As to why the WAF ACL rule is not working as intended, there is likely a configuration issue. To troubleshoot the issue quickly, I suggest opening a case with AWS Support:

The difference between WAF geographic match rule statements and CloudFront geographic restrictions is that you can use the former with other AWS WAF statements to build sophisticated filtering. For example, if you wanted to allow certain traffic from certain IPs in Singapore, but deny other traffic from Singapore, the WAF rule would be useful.

Considering your use case, creating a geographic restriction on CloudFront would be the most convenient solution. You can block all traffic from Singapore with 99.8% accuracy. In order to do so, please follow these steps:

  1. Sign in to the AWS Management Console and open the CloudFront console at
  2. Choose the distribution that you want to update.
  3. Choose Geographic restrictions.
  4. Choose Edit.
  5. Select Allow list to create a list of allowed countries, or Block list to create a list of blocked countries.
  6. Add the desired countries to the list, then choose Save changes.

For more on how AWS WAF works with Amazon CloudFront features:

답변함 2년 전
지원 엔지니어
검토됨 2년 전

Unfortunately, at this point in time the Amplify Console officially does not support AWS WAF integration with the generated CloudFront URL. The Amplify CloudFront URL does come with AWS Shield standard.

The Amplify service team have identified this as a known feature request. Please refer to this open GitHub issue which is pertaining to the feature request and it can be tracked here:

There's a way to setup WAF for your custom domain creating a documentation but the underlying domain is still technically live, so it's security by obscurity in essence.

profile pictureAWS
답변함 일 년 전

To enable AWS WAF for web applications hosted by AWS Amplify please refer to the following documentation -

답변함 9달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠