Project: KICS (Provisioning / Security & Compliance)
File: 0f139403-303f-467c-96bd-e717e6cfd62d.md

title: CloudFront Without WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0f139403-303f-467c-96bd-e717e6cfd62d Query name: CloudFront Without WAF Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: 2010-09-09 Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value Tags: Key: string-value Value: string-value ``` ```json title="Positive test num. 2 - json file" hl_lines="13" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "Tags": [ { "Key": "string-value", "Value": "string-value" } ], "DistributionConfig": { "Enabled": true, "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] }, "IPV6Enabled": "boolean-value", "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ] } } } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="21" AWSTemplateFormatVersion: 2010-09-09 Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value WebACLId: "" Tags: Key: string-value Value: string-value ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="36" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Enabled": true, "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] }, "IPV6Enabled": "boolean-value", "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ], "WebACLId": "" }, "Tags": [ { "Value": "string-value", "Key": "string-value" } ] } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value WebACLId: string-value Tags: Key: string-value Value: string-value ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Enabled": true, "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] }, "IPV6Enabled": "boolean-value", "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ], "WebACLId": "string-value" }, "Tags": [ { "Value": "string-value", "Key": "string-value" } ] } } } } ```