Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Does AWS WAF inspect requests that are served from CloudFront cache?

1

Does AWS WAF evaluate requests that are served from the CloudFront cache? Or are WAF rules applied only when the request is forwarded to the origin (i.e., cache miss)?

I’d like to confirm this to ensure that the WAF provides protection even for cached responses (e.g., in case of query parameters or rate limiting).

Any clarification or documentation link would be appreciated.

Topics
Security, Identity, & ComplianceNetworking & Content DeliveryAWS Well-Architected Framework
Tags
Amazon CloudFrontAWS WAFSecurity
Language
English

asked a year ago364 views

2 Answers
1
Accepted Answer

The short answer is yes, WAF will evaluate requests before they reach your CloudFront cache. Whilst we don't explicitly describe this scenario in our docs, you can validate it via other documented items, specifically, how WAF works with CloudFront lambda@edge functions. Our docs here call out the fact that WAF inspects requests before they reach lambda@edge functions:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-event-request-response.html "If you're using AWS WAF, the Lambda@Edge viewer request is executed after any AWS WAF rules are applied."

And you can see here that the triggers for lambda@edge can be set both before (e.g. on viewer request) and after caching:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-cloudfront-trigger-events.html

AWS

answered a year ago

  • Dhairya Patel
    a year ago

    Hi mofaized. Thank you for your detailed answer! From your references I was able to conclude that:

    1. Since the Lambda@Edge viewer request executes before it checks the CloudFront cache [Link 2], and
    2. AWS WAF rules are applied before it is executed [Link 1],
    3. WAF rules evaluate requests before reaching the cache.
-1

You can find this information implicitly and explicitly in AWS documentation. A good starting point is the "How CloudFront Works" or "AWS WAF integration with CloudFront" sections. For example, the AWS documentation states: "When you associate a web ACL with a CloudFront distribution, AWS WAF starts to evaluate all incoming requests at the edge locations before they reach your web application."

Here's a relevant link to the AWS WAF Developer Guide, which touches on this integration: https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html

answered a year ago

EXPERT

reviewed a year ago

  • Dhairya Patel
    a year ago

    Hi Bhawesh. Thank you for the prompt response.

    Could you please provide a reference to your line—"When you associate a web ACL with a CloudFront distribution, AWS WAF starts to evaluate all incoming requests at the edge locations before they reach your web application."—?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content