How to integrate CloudFront distribution to AWS WAF by using CloudFormation?

Question

I am trying to add CloudFront distribution to AWS WAF by using CloudFormation and have tried this,

"Type": "AWS::WAFRegional::WebACLAssociation",
            "Properties": {
                "ResourceArn": "arn:aws:cloudfront::AccountID:distribution/CloudFrontID",
                "WebACLId": {
                    "Ref": "WebACLName"
                }

But I ended up with this error: The referenced item does not exist. (Service: AWSWAFRegional; Status Code: 400; Error Code: WAFNonexistentItemException; Request ID: 149453cd-1606-11e8-86b2-a3efdb49d9d1)

Bowser

Answer 1

AWS::WAFRegional::* is actually for association with Application Load Balancers. You'll want to use the AWS::WAF::* types (without the "Regional").

Then for the association you have to do it from the CloudFront distribution itself. Like so:

"myDistribution": {
  "Type": "AWS::CloudFront::Distribution",
  "Properties": {
    "DistributionConfig": {    
      "WebACLId": { "Ref" : "MyWebACL" },

That part is explained in the CloudFormation documentation.

Groome

thanks for the answer, so we can only associate them from CloudFront end? – Bowser