Question

A retail company serves its web application through Amazon CloudFront with an Application Load Balancer (ALB) origin. AWS WAF is associated with the CloudFront distribution to filter malicious requests. During a security review, the team discovers that attackers are bypassing CloudFront by sending requests directly to the ALB's public DNS name, avoiding the WAF rules entirely. The ALB must remain internet-facing to support the CloudFront integration. Which combination of controls MOST effectively ensures that only CloudFront-originated traffic reaches the ALB?

Accepted Answer

Configure CloudFront to add a custom HTTP header with a secret value, and add an ALB listener rule that forwards only requests containing that header while restricting the ALB security group to the AWS-managed CloudFront prefix list.

Answer

Attach AWS WAF directly to the ALB with the same rules and remove WAF from the CloudFront distribution to consolidate inspection at the origin.

Answer

Enable AWS Shield Advanced on the ALB and create a Network ACL that denies all inbound traffic except from CloudFront edge locations.

Answer

Place the ALB in a private subnet and use a NAT gateway so CloudFront can reach it while blocking direct public access.