Cloudfront WAF Association (Fail open or Closed)

Hello,

WAF fails open with CloudFront & fails closed default for ALB\API GW. However its not documented in any public facing material. There is no option to choose between "Fail Open" or "Fail Close" for CloudFront-WAF.

When associating AWS WAF with Amazon CloudFront, there is indeed no explicit option to choose between "Fail Open" or "Fail Close" as you would find with Application Load Balancers (ALBs). This is not an oversight on your part; the option simply doesn't exist for CloudFront-WAF associations.

The behavior for CloudFront when AWS WAF encounters an error or is unable to evaluate a request is to "Fail Open." This means that if AWS WAF experiences any issues or cannot process a request, CloudFront will allow the request to pass through to the origin, essentially bypassing the WAF protection.

This "Fail Open" behavior is designed to ensure that your application remains accessible even if there are problems with AWS WAF. It prioritizes availability over strict security enforcement in error scenarios. However, it's important to note that this only applies in cases where WAF itself encounters an error or cannot process the request. Under normal circumstances, WAF will continue to apply your configured rules and protect your CloudFront distribution as expected.

While you can't change this behavior directly for CloudFront-WAF associations, you can implement additional security measures at other layers of your application architecture if you require stricter controls. For example, you could implement security groups, network ACLs, or origin-level protections to provide defense-in-depth for your application.
Sources
Introducing CloudFront Security Dashboard, a Unified CDN and Security Experience | Networking & Content Delivery
AWS WAF integration design - Guidelines for Implementing AWS WAF

CloudFront fail-open behaviour is documented here where it says:

On some occasions, AWS WAF might encounter an internal error that delays the response to associated AWS resources about whether to allow or block a request. On those occasions, CloudFront typically allows the request or serves the content, while the Regional services typically deny the request and don't serve the content.

There is currently no option to choose 'fail-closed' for AWS WAF on Cloudfront, however if you would like to request this feature, please raise a support case.

In the meantime, a work-around is to configure AWS WAF on CloudFront to add a request header, check for the presence of the header on the origin and reject the request if header isn't there.