Want to use WAF with a Lightsail Instance / WAF can't see Lightsail Cloudfront Distribution OR Lightsail Load Balancer

Question

A lot of the content on this topic is 2-3 years old, and much of it is contradictory.

I have a lightsail instance. Within lightsail I've configured it to use a Cloudnet distribution.  This distribution is invisible to WAF.

I subsequently created a loadbalancer within Lightsail, and that load balancer is also invisible to WAF.

Is there anyway to make WAF see these resources? Can I set up a VPC that makes these resources visible to WAF?

Right now it seems completely impossible to use WAF with lightsail resources (instances, distributions, load balancers created using standard lightsail tools) despite all the posts that say its possible.

Ideally I would like to have WAF protect the cloudnet distribution. I don't expect to have a lot of traffic to this site, and the distribution will be caching almost everything, but I do need waf to handle bot traffic.

Thanks in advance for all answers . . . I'm sure someting definitive would help a lot of people.

Riku_Kobayashi · Answer

AWS WAF cannot be configured on distributions or load balancers created from Lightsail.  
https://repost.aws/knowledge-center/lightsail-considerations-for-use  
> Firewall services: You can use AWS firewall services, such as AWS WAF and AWS Shield, with Application Load Balancer. These services aren't supported in Lightsail load balancer.

Perhaps the article you saw is about setting up AWS WAF on an ALB outside of an Amazon CloudFront or Lightsail VPC.  
So, to set up AWS WAF, please create CloudFront from the CloudFront screen, not from the Lightsail screen.  
Please refer to the documentation for creating CloudFront.  
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-create-delete.html

Want to use WAF with a Lightsail Instance / WAF can't see Lightsail Cloudfront Distribution OR Lightsail Load Balancer

Relevant content