Project: KICS (Provisioning / Security & Compliance)
File: 6d19ce0f-b3d8-4128-ac3d-1064e0f00494.md

title: CloudFront Without WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6d19ce0f-b3d8-4128-ac3d-1064e0f00494 Query name: CloudFront Without WAF Platform: Crossplane Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8 48" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 webACLID: 473e64fd-f30b-4765-81a0-62ad96dd167a origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 webACLID: 473e64fd-f30b-4765-81a0-62ad96dd167a origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ```