I read this http://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html

I read that ACL can be associated with a cloudfront as well as with load balancer.

I could find the tutorial for cloudfront http://docs.aws.amazon.com/waf/latest/developerguide/tutorials-rate-based-blocking.html

But i am unable to find any tutorial for associating ACL with load balancer. Nor i could find any option on AWS console UI for the same.

Any help.

  • Are you trying to restrict a load balancer to a specific set of IPs? – Tim Jun 6 '17 at 20:51
  • Yes Exactly Tim. But that set of IPs should be dynamically programmable with some lamda function. – codeofnode Jun 7 '17 at 9:10

Load balancers need subnets to run, you can set up NACL's at the subnet level for each subnet that ELB is provisioned with. But if you're already using AWS WAF in front of your ALB why do you need to setup NACL at that level? If you're using Cloudfront in front of the ALB's you can setup your ALB security groups to only be accessabile from Cloudfront IP address ranges using this aws labs code

  • Your VPC automatically comes with a modifiable default network ACL. By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic.

  • You can create a custom network ACL and associate it with a subnet. By default, each custom network ACL denies all inbound and outbound traffic until you add rules.

  • Each subnet in your VPC must be associated with a network ACL. If you don't explicitly associate a subnet with a network ACL, the subnet is automatically associated with the default network ACL.

  • You can associate a network ACL with multiple subnets; however, a subnet can be associated with only one network ACL at a time. When you associate a network ACL with a subnet, the previous association is removed.

  • A network ACL contains a numbered list of rules that we evaluate in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any subnet associated with the network ACL. The highest number that you can use for a rule is 32766. We recommend that you start by creating rules with rule numbers that are multiples of 100, so that you can insert new rules where you need to later on.

  • A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.

  • Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).


  • Your information was really useful. But Are network ACL allows to define rules to block a certain range of IP addresses and allow request not in range if those ip addresses? If yes, can those set of IP addresses be modified programmatically from Lamda function.? – codeofnode Jun 7 '17 at 9:24
  • The AWS labs code has a python lambda function that does just that. – strongjz Jun 7 '17 at 9:44
  • the repo github.com/awslabs/aws-cloudfront-samples/tree/master/… says that lamda function listens to AmazonIpSpaceChanged SNS topic. Can i make that listen to a input request to load balancer, that has ip address of client in the event data? – codeofnode Jun 7 '17 at 12:02
  • You could have it monitor a S3 bucket and on upload event read a file and update sec groups. – strongjz Jun 7 '17 at 12:06
  • Do load balancer have activity logger that puts the log into s3? from where can i configure that? – codeofnode Jun 7 '17 at 12:36

Here you are, a good document on how to associate a WebACL to a Load Balancer.


If you are using CloudFormation:


  • While the links may contain all the needed info it is better to add the info to your answer. Links do break and then your answer is useless to future visitors – Dave M Dec 20 '18 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.