For Default web ACL action for requests that don't match any rules, choose Allow, and then choose Next.

For Associated AWS resources, associate your ALB, then choose Next.

Choose Create web ACL, and then enter a Name.

For Region, select the AWS Region where your ALB is located.

In the navigation pane, under AWS WAF, choose Web ACLs.

If you have an existing web ACL associated to your ALB, then proceed to Create a rule.

Note: If you don't have an existing web ACL associated with your ALB, then follow the steps in Create an AWS WAF web ACL. Important: Consider the Header name and Value as secure credentials, like a user name and password.Ĭreate a rule in your AWS WAF web ACL associated with the ALB to block the requests that don't contain the custom HTTP header secret value An example Header name is Custom-header and Value is Random-12345.

For Add custom header, add the Header name and Value.

Note: If you don't have an ALB origin, see Creating a distribution or Updating a distribution.

Select your ALB origin, and then choose Edit.

From the navigation pane, choose Distributions.

Create a rule in your AWS WAF web ACL associated with the ALB to block requests that don't contain the custom HTTP header secret value.Ĭonfigure CloudFront to add a custom HTTP header with a secret value in the requests that it sends to the ALB.

Configure CloudFront to add a custom HTTP header with a secret value in the requests that CloudFront sends to the ALB.

To restrict direct traffic to an ALB and allow traffic through only CloudFront using AWS WAF, do the following:

Aws waf cloudfront