Setup WAF for CloudFront and Load Balancer

Question

I'm setting up WAF for my Laravel application. My current flow is user request will go from CloudFront → LoadBalancer → Laravel Servers. I already set up WAF for cloudfront. Do I need to setup WAF for LoadBalancer?

Answer 1

Setting up a WAF on the Load Balancer is your decision, however, from a security point of view it would be advised to have some sort of protection on the ALB.

From experience I see that CloudFront Distributions normally would have an additional header with a secret value attached. Then a WAF attached to the ALB would deny any traffic that didn't have the header with the value of the secret.

Answer 2

I'm setting up WAF for my Laravel application. My current flow is user request will go from CloudFront → LoadBalancer → Laravel Servers. I already set up WAF for cloudfront. Do I need to setup WAF for LoadBalancer?