AWS API Gateway with AWS WAF

Question

I wish to use AWS Web Application Firewall service with AWS API Gateway. However AWS WAF works only with AWS CloudFront distributions.

If you refer this post: https://forums.aws.amazon.com/message.jspa?messageID=677382.

You will realise API Gateway creates a CloudFront distribution behind the scenes. But I don't see this distribution neither in the CloudFront console nor in the WAF console.

Is there any way to make use of the CloudFront distribution created by API Gateway for WAF?

Answer 1

Well that is not possible,

Reason:

API Gateway would not provide access to back CloudFront distribution. To use WAF you would have to create a second distribution, which is inefficient but should functionally work.

Answer 2

Why don't you associate the WAF with CloudFront.
Look when you create a WAF in step 4 you have to choose resources of Cloudfront distribution in that select the default distribution created by API gateway.
May be this would help.

Answer 3

I had a similar issue, what is best you can do at this stage is ,

have api gateway terminate the SSL - make a call from api gateway to your alb , elb or nlb (is the best , if it fits your architecture) - have alb protected by the WAF with two ruleset 1. white list all the api gateways ip 2. have the http header accepted by api gateway only

this way you are securing your infra to its best.

if you have nlb, then you can have the private link to NLB straight, keep in mind NLB doesnt support path based routing, and cross zone application failover

I have asked AWS to raise a feature request for the same