Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Receive external proxy protocol v2 traffic and get it to Cloudfront CDN?

0

We're implementing a new WAF and we want it to be in front of our Cloudfront CDN, in order to protect potential attacks on the CDN itself. The problem we faced is that the CDN can no longer geolocate the client, because the client IP is forwarded in a specific header. We also chatted with AWS support, but basically they said the CDN can only work on the TCP connection.

Currently we have AWS WAF, so it should be safe to assume that somehow this can be done. I've been searching the web to dig deeper. I came across the concept of proxy protocol and from what I understand, theoretically we could achieve what I have in mind with something like this:

WAF (sends proxy protocol) => NLB (receives proxy protocol) => CDN

Can this (or something that preserves the client IP and allows the CDN to add the headers correctly) be achieved?

Topics
Networking & Content Delivery
Tags
Amazon CloudFrontNetworking & Content Delivery
Language
English

asked a year ago250 views

1 Answer
0
Accepted Answer

One of the purposes of CloudFront is to protect your application from attacks - trying to create an architecture where you're trying to protect CloudFront is going to create a lot of complexity and cost for you - assuming that you can get it to work anyway.

Given that you are using AWS WAF, why not use that in conjunction with CloudFront to deal with attacks that you are concerned about?

To your actual question: CloudFront only accepts HTTP and HTTPS connections from clients. It does not support PPv2 and you cannot get WAF on CloudFront to interpret PPv2 for you because CloudFront has to first terminate the HTTP/HTTPS connection and then pass the session onto WAF. If the session it receives is not valid HTTP/HTTPS it will not accept it - and that excludes a session which is using a PPv2 header.

EXPERT

answered a year ago

AWS
EXPERT

reviewed a year ago

  • Otacon
    a year ago

    Hello,

    we'll stop using AWS WAF, because Radware is (theoretically) smarter and easier to maintain, especially from a logging perspective. Clear, thanks for the response, so no matter what we put in front of the CDN there's no way to manipulate the request into letting the CDN think it's comining from the actual client. Good to know. In the meantime we started exploring the Lambda integration of Radware, that might be the better solution for us, if we're sure it works like we think (with reference to my question about Lambda optimisations). Thanks again.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content