Question

A company runs a public HTTPS web application behind an Application Load Balancer (ALB) that they want to protect with AWS WAF. They also have a requirement from their security team: the backend EC2 instances must see the original client source IP addresses in the application logs for fraud analysis, without deploying any additional software on the instances. The ALB terminates TLS. Which approach meets both the WAF protection and original client IP requirements with the least operational overhead?

Accepted Answer

Associate the AWS WAF web ACL with the ALB and configure the application to read the X-Forwarded-For HTTP header for the original client IP.

Answer

Replace the ALB with a Network Load Balancer, enable client IP preservation on the target group, and attach the WAF web ACL to the NLB.

Answer

Keep the ALB, enable Proxy Protocol v2 on the target group, and associate the WAF web ACL with the ALB so the instances receive the TCP source IP.

Answer

Place a Gateway Load Balancer in front of the ALB, associate the WAF web ACL with the GWLB, and forward traffic transparently to preserve the source IP.