Question

A company runs a public web application behind an Application Load Balancer (ALB) in the us-east-1 Region. The security team wants to protect the application from common exploits using AWS WAF and needs the Web ACL to inspect requests before they reach the backend targets. During implementation, the engineer creates a Web ACL in the CloudFront (Global) scope but cannot associate it with the ALB. What is the correct approach to protect the ALB with AWS WAF?

Accepted Answer

Create the Web ACL with a Regional scope in us-east-1 and associate it directly with the ALB.

Answer

Keep the CloudFront-scope Web ACL and associate it with the ALB by enabling cross-scope association in the WAF console.

Answer

Deploy a CloudFront distribution in front of the ALB and associate the Global Web ACL, because ALBs cannot be protected by AWS WAF directly.

Answer

Create the Web ACL in the CloudFront (Global) scope but change its Region to us-east-1 so it becomes compatible with the ALB.