I have successfully blocked an IP in waf which is configured to work with Cloud front

Is there a way to block IP address before it reaches cloudfront? It wouldn’t seem possible as I tried blocked in ACL which prevents access to my servers, but since cloudfront and WAF are in front to handle all requests I seem stuck.

I am trying to save money on my bill as this counts against total requests.

Is there any way?

1 Answer 1


There is no way to block a request "before" it arrives at CloudFront, since there isn't anything before CloudFront in the chain.

This is true even when you use WAF "in front." WAF is an adjunct platform -- unlike a "firewall" as you might typically imagine one, WAF isn't actually in front of CloudFront, and traffic doesn't actually pass through it. Instead, when CloudFront receives each new request, it forwards a copy of the first ~16kB of headers and body plus some metadata to WAF, which analyzes it and returns an allow/deny decision based on your rules. CloudFront then enforces the decision of WAF by continuing to process the request or by immediately denying it.

  • What about blocking it in access control in VPC? Sep 7, 2019 at 22:57
  • CloudFront is not inside VPC. VPC Security Groups and Network ACLs would only be able to see the IP addresses of CloudFront itself, as it accessed your servers or load balancers. Sep 7, 2019 at 23:08
  • Got it. Didn’t know if there was a way to do that Sep 7, 2019 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.