Best Practice to protect Azure Source Using Cloudfront and WAF

AWS WAF primarily supports HTTP/HTTPS workloads. By default, AWS WAF doesn't directly support non-AWS origins. However, suppose you're able to integrate or expose your Azure-based application through CloudFront as the origin. In that case, you can certainly leverage AWS CloudFront for content delivery and enhance security by applying AWS WAF protection to the traffic flowing through CloudFront.

Additionally, you can enhance CloudFront origin security for non-AWS origins, including on-premise or third-party cloud infrastructure, by using third-party firewalls. AWS provides a helpful guide on how to implement this using CloudFront in combination with external firewalls. For more details, you can refer to this blog post: How to enhance CloudFront origin security of on-premise web servers using third-party firewalls.

Use CloudFront as a CDN

CloudFront can serve as a global content delivery network (CDN) for your Azure-hosted origin, providing several benefits:

1. Improved performance by caching content at edge locations closer to users.
2. Reduced load on your Azure origin server.
3. Additional layer of security by hiding your origin server's IP address.

Configure CloudFront Distribution

1. Set up a CloudFront distribution with your Azure origin:

   • In the CloudFront console, create a new distribution.
   • For the origin domain, use the public DNS name of your Azure resource.
   • Configure the origin protocol policy (HTTP or HTTPS).

2. Add alternate domain names (CNAMEs) for your multiple domains:

   • In the CloudFront distribution settings, add all your domain names in the "Alternate Domain Names (CNAMEs)" field.

3. Set up SSL/TLS:

   • Use AWS Certificate Manager (ACM) to provision a certificate for your domains.
   • Ensure the certificate is created in the US East (N. Virginia) region.
   • Associate the certificate with your CloudFront distribution.

Implement AWS WAF

Integrate AWS WAF with your CloudFront distribution for additional security:

1. Create a Web ACL in AWS WAF:

   • Configure rules to protect against common web attacks (e.g., SQL injection, cross-site scripting)[6].
   • Set up IP-based rules if needed.

2. Associate the Web ACL with your CloudFront distribution:

   • In the CloudFront console, edit your distribution's settings.
   • Under "AWS WAF," select "Enable" and choose your created Web ACL.

Origin Protection

To ensure only CloudFront can access your Azure origin:

1. Use custom headers:

   • Configure CloudFront to add a secret custom header to requests sent to your origin.
   • Set up your Azure origin to only accept requests with this secret header.

2. IP restrictions:

   • Configure your Azure resource to only accept traffic from CloudFront IP ranges.
   • Regularly update these IP ranges as CloudFront's IP addresses can change.

DNS Configuration

1. Use Amazon Route 53 for DNS management:
   • Create alias records in Route 53 pointing your domain names to the CloudFront distribution.

Additional Security Measures

1. Enable HTTPS between CloudFront and your Azure origin.
2. Implement proper logging and monitoring on both AWS and Azure sides.
3. Regularly rotate any shared secrets used for origin custom headers.

By implementing these practices, you can effectively protect your Azure origin using AWS edge services, providing a secure and performant multi-cloud solution. This setup also facilitates a potential future migration to AWS, as much of the front-end infrastructure will already be in place.

Finally, here are some useful links for you: [1]https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html

[2] https://repost.aws/ja/questions/QUGfaD2IwsTuirmrDTrQ6JEg/is-there-a-way-to-not-have-2-cloudfront-distributions-for-the-1-website-www-base-domains

[3] https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/

[4] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html

[5] https://repost.aws/it/questions/QU7h6DKzX6S266tFtKzkXUWA/protecting-origin-for-exclusive-cloudfront-access-best-practices

[6] https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html

[7] https://repost.aws/knowledge-center/multiple-domains-https-cloudfront

[8] https://aws.amazon.com/jp/blogs/networking-and-content-delivery/accelerate-and-protect-your-websites-using-amazon-cloudfront-and-aws-waf/