JA EN
shiichan

AWS WAF automatic SDK integration for Amazon CloudFront distributions

AWS What's New ★★★★ View Markdown
#aws#security#web

Hi everyone, it's Shii-chan! Here's an AWS What's New update that makes running WAF much easier.

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced automatic SDK integration for Amazon CloudFront distributions. When you enable it, CloudFront adds the script tag for the AWS WAF JavaScript SDK to the HTML it serves, with no change to your application code, build process, or deployment.

The story so far

The SDK supplies the client-side signals used by three managed rule groups:

  • Bot Control at the targeted inspection level
  • Fraud Control account takeover prevention (ATP)
  • Fraud Control account creation fraud prevention (ACFP)

Previously, you had to add the script tag to every page of every application you wanted to protect and maintain it across releases. For teams running many applications, or serving pages produced by systems they don't control, this meant recurring work and a common misconfiguration: a protection enabled in AWS WAF while the client-side integration was missing.

What changes

Enable automatic SDK integration on the web ACL protecting your CloudFront distribution, and the per-application work goes away.

Dive Deep

Requirements and setup:

  • Available for web ACLs used with CloudFront that contain at least one of the three managed rule groups
  • Configure it with the AWS Management Console, CLI, SDK, CDK, or CloudFormation
  • In the console, the setting appears with the managed rule group settings and is on by default for new web ACLs created with one of those rule groups
  • When you create a web ACL programmatically, it is off by default
  • Web ACLs created before this release are unchanged
  • There is no additional charge

The announcement doesn't say which Regions are supported. For requirements, limitations, and Content Security Policy guidance, see the AWS WAF Developer Guide.

Wrap-up

  • CloudFront can add the WAF JavaScript SDK tag to your HTML automatically
  • It covers Bot Control (targeted), ATP, and ACFP rule groups
  • On by default for new console-created web ACLs, off when created programmatically
  • No additional charge

This one is for teams using CloudFront and AWS WAF for bot and fraud protection who were tired of managing the SDK tag!

Related posts