AWS WAF on custom website

Question

I have a website that is not protected by a WAF. I would like to configure a AWS WAF to it.

I could not find any option on AWS WAF to protect a custom website, just cloud front deployment.

Is it possible to protect a custom website that is not using Cloud Front?

Answer 1

No, you can't protect a website with AWS WAF without serve it through CloudFront.

You can read more here on this FAQ: https://aws.amazon.com/waf/faq/

But it's not that hard to install CloudFront over your (static or dynamic) website, here are a few links to the documentation:

• Hosting a Static Website on Amazon Web Services
• Amazon CloudFront - Dynamic Content Delivery

Answer 2

Yes it is possible only if your website or API hosted in ALB (Application Load Balancer). For those who have come here to find out how you could achieve this, here is the reference

• Implementing AWS WAF