How do I associate a WAF with an API Gateway?

Question

I set up an API Gateway route, which works. I now want to protect it with a WAF.

I found https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html, which refers to a "Settings" tab inside the stage editor in API Gateway; this doesn't exist for me. All that I see associated with the stage are stage variables and tags.

Likewise, from the WAF, it looks like I should be able to associate an API Gateway resource with the WAF; however, my route/stage isn't findable in any of the dialogs.

What gives? I am on free tier for both, if that is a factor.

kentrad · Answer

WAF is only available for REST APIs, not HTTP. https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html#waf-intro

Antonio_Lagrotteria · Answer

Hi, WAF is available for Rest api type as mentioned above.

If you have http api type, you can either front your api Gateway with CloudFront and associate WAF with CloudFront, or add an Application Load Balancer (ALB) after the api gateway, and associate WAF with the ALB.

Hope it helps ;)

Riku_Kobayashi · Answer

The following steps in AWS WAF will help you to set up the system.  
When linking AWS WAF Web ACLs, create a Web ACL in the same region as the API Gateway.  
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html

rePost-User-7220584 · Answer

Yeah, that doesn't work either because the API Gateway resource is not listed in the Add AWS Resources tab.

The region might be the issue - I can only create ACLs in "Global" (they others are grayed out), whereas the API Gateway is us-east-1.

Riku_Kobayashi · Answer

My screen allows me to choose a region on the Web ACL screen.  
![waf](/media/postImages/original/IMhfGnfHZwRKSJoeDQhk80kw)

When creating the Web ACL, did you select "Regional resources"?  
![waf1](/media/postImages/original/IM-tYNZdGSSemSEJQCVon_4Q)

rePost-User-7220584 · Answer

Ah yes, you are right. Sorry, was confused by the region in the top bar, which is set to global when I click to ACLs. However, I have the same view as you for the actual creation; and, my ACL is created in US-east-1, as is the API gateway. Here's what I see:

Enter image description here

![Enter image description here](/media/postImages/original/IMeqqBQgTcS4arjSKTytx_rw)

![Enter image description here](/media/postImages/original/IMIanGMLcrRS6m4bhIxXqSOA)

![Enter image description here](/media/postImages/original/IM-YElG0yuSPGe1I2wFejsqw)

![Enter image description here](/media/postImages/original/IMLGXdn9DcT5SBA7hLTfTAAQ)

How do I associate a WAF with an API Gateway?

Relevant content