CloudFront has no configured web application firewall

ID

aws_cloudfront_waf

Severity

low

Vendor

AWS

Resource

Network

Tags

asvs50-v13.1.1, reachable

Description

CloudFront has no configured web application firewall (WAF). It can mitigate different attacks on your web application.

To fix it you must configure web_acl_id property.

Learn more about this topic at AWS CloudFront WAF.

Examples

---
- name: Example playbook
  hosts: localhost
  tasks:
    - name: create a distribution
      community.aws.cloudfront_distribution:
        state: present
        caller_reference: unique test distribution ID
        origins:
            - id: 'my test origin-000111'
              domain_name: www.example.com
              origin_path: /production
              custom_headers:
                - header_name: MyCustomHeaderName
                  header_value: MyCustomHeaderValue
        default_cache_behavior:
          target_origin_id: 'my test origin-000111'
          forwarded_values:
            query_string: true
            cookies:
              forward: all
            headers:
             - '*'
          viewer_protocol_policy: allow-all
          smooth_streaming: true
          compress: true
          allowed_methods:
            items:
              - GET
              - HEAD
            cached_methods:
              - GET
              - HEAD
        logging:
          enabled: true
          include_cookies: false
          bucket: mylogbucket.s3.amazonaws.com
          prefix: myprefix/
        enabled: false
        comment: this is a CloudFront distribution

Mitigation / Fix

---
- name: Example playbook
  hosts: localhost
  tasks:
    - name: create a distribution
      community.aws.cloudfront_distribution:
        state: present
        caller_reference: unique test distribution ID
        origins:
            - id: 'my test origin-000111'
              domain_name: www.example.com
              origin_path: /production
              custom_headers:
                - header_name: MyCustomHeaderName
                  header_value: MyCustomHeaderValue
        default_cache_behavior:
          target_origin_id: 'my test origin-000111'
          forwarded_values:
            query_string: true
            cookies:
              forward: all
            headers:
             - '*'
          viewer_protocol_policy: allow-all
          smooth_streaming: true
          compress: true
          allowed_methods:
            items:
              - GET
              - HEAD
            cached_methods:
              - GET
              - HEAD
        logging:
          enabled: true
          include_cookies: false
          bucket: mylogbucket.s3.amazonaws.com
          prefix: myprefix/
        enabled: false
        comment: this is a CloudFront distribution
        web_acl_id: "WEB_ACL_ID"