Cloud & Infrastructure
Bug Report
AWS WAF on CloudFront bypassed by calling the ALB directly: locking down the origin
Our WAF rate limit and managed rules worked perfectly, for anyone polite enough to go through CloudFront. A scripted client hitting the ALB hostname directly skipped all of it. Here is how we found it, why it happens, and the layered origin protection we now ship by default.