Ravi Sir's Cards › AWS
Edge or origin WAF?
This comparison card contrasts Edge or origin WAF. Edge WAF on CloudFront is described as stops abuse before origin. It also notes pairs with cache. Regional WAF on ALB: Defense-in-depth if CF bypassed (should not be).
Read card text
What this card says
Edge or origin WAF?
Edge WAF on CloudFront
Stops abuse before origin; pairs with cache.
Regional WAF on ALB
Defense-in-depth if CF bypassed (should not be).
Key points
Public internet users.
Locked-down origins only.
Example
CLOUDFRONT ACL / REGIONAL ACL on ALB
Use when
Primary.
Optional second layer.