cloudfront-waf-hardening

CloudFront + WAF Hardening

Lock down an ALB-backed service so it is only reachable through CloudFront, with WAF path-level access control.

When to Activate

• Deploying LiteLLM (or any API proxy) on EKS/ECS behind an ALB
• User asks to "add CloudFront" or "lock down ALB" or "hide the ALB"
• Hardening an existing internet-facing ALB
• Restricting public access to API-only paths (no Admin UI)

Architecture

Client (HTTPS)
  |
  v
CloudFront Distribution
  |  adds X-CloudFront-Secret header
  v
ALB (HTTP :80, SG = CloudFront prefix list only)
  |
WAF Web ACL (default: Block)
  |  Rule: Allow IF secret header matches AND path in whitelist
  v
Backend (EKS Pod / ECS Task / EC2)

Three layers of defense:

1. ALB Security Group — only allows CloudFront IP ranges (AWS managed prefix list)
2. WAF header verification — blocks requests without the correct X-CloudFront-Secret
3. WAF path whitelist — even valid CloudFront requests are blocked if the path is not allowed

Prerequisites

• AWS CLI v2 with sufficient IAM permissions (wafv2, cloudfront, ec2, elasticloadbalancing)
• An existing ALB with a known ARN
• The ALB's Security Group ID
• (Optional) An existing K8s Ingress group if using EKS ALB Controller

Step-by-Step Procedure

Step 1: Generate a CloudFront Secret

CF_SECRET=$(python3 -c "import secrets; print(secrets.token_urlsafe(32))")
echo "CloudFront Secret: $CF_SECRET"

Store this value securely. It will be configured in both CloudFront (origin header) and WAF (match rule).

Step 2: Create CloudFront Distribution

Generate the distribution config with a custom origin header:

ALB_DNS="<alb-dns-name>"  # e.g. k8s-myapp-abc123.region.elb.amazonaws.com

python3 -c "
import json

config = {
    'CallerReference': '$(date +%s)',
    'Comment': 'Hardened distribution for ALB',
    'Enabled': True,
    'Origins': {
        'Quantity': 1,
        'Items': [{
            'Id': 'alb-origin',
            'DomainName': '$ALB_DNS',
            'CustomOriginConfig': {
                'HTTPPort': 80,
                'HTTPSPort': 443,
                'OriginProtocolPolicy': 'http-only',
                'OriginReadTimeout': 60,
                'OriginKeepaliveTimeout': 5
            },
            'CustomHeaders': {
                'Quantity': 1,
                'Items': [{
                    'HeaderName': 'X-CloudFront-Secret',
                    'HeaderValue': '$CF_SECRET'
                }]
            }
        }]
    },
    'DefaultCacheBehavior': {
        'TargetOriginId': 'alb-origin',
        'ViewerProtocolPolicy': 'redirect-to-https',
        'AllowedMethods': {
            'Quantity': 7,
            'Items': ['GET','HEAD','OPTIONS','PUT','POST','PATCH','DELETE'],
            'CachedMethods': {'Quantity': 2, 'Items': ['GET','HEAD']}
        },
        'CachePolicyId': '4135ea2d-6df8-44a3-9df3-4b5a84be39ad',
        'OriginRequestPolicyId': '216adef6-5c7f-47e4-b989-5492eafa07d3',
        'Compress': True
    },
    'PriceClass': 'PriceClass_200'
}

with open('/tmp/cf-dist.json', 'w') as f:
    json.dump({'DistributionConfig': config}, f)
print('Config written to /tmp/cf-dist.json')
"

aws cloudfront create-distribution --cli-input-json file:///tmp/cf-dist.json