Securing Custom Origins with AWS WAF
Publication date: July 26, 2022 (Diagram history)
This architecture shows how to protect any endpoint against common web vulnerabilities. You use AWS WAF with custom origins and custom secret headers in Amazon CloudFront.
Securing Custom Origins with AWS WAF
-
Users make a request to the web application. DNS records direct the user to the closest CloudFront edge location.
-
AWS WAF inspects the traffic by using both custom and managed rules. It checks for common web exploit attacks. AWS WAF logs traffic for future analysis and can block malicious traffic.
-
CloudFront injects a secret custom header into the request and redirects it to the on-premises web application.
-
The web application drops or blocks any request without the secret custom header. This ensures AWS WAF inspects all traffic.
-
Users receive the response to their request from CloudFront. Data caches at the edge location for the next request.
-
An Step Functions workflow orchestrates the secret header rotation and deployment process on a configurable schedule.
-
The Step Functions workflow generates a new secret for the custom header value. It stores the value in AWS Systems Manager Parameter Store.
-
The new header value is distributed to one or more web app servers through SSM Agent and Automation Runbooks. After finalization, the workflow deploys the new header to CloudFront.
-
The on-premises firewall updates to allow only CloudFront IP addresses to the web application as an additional protection layer.
Further reading
For additional information, refer to
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Initial publication | Reference architecture diagram first published. | July 26, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
