We're currently using CloudFront for our HTTP API gateway, and while it's been functioning well, we've been facing issues with users in Spain unable to access our platform on weekends. I've heard that AWS WAF can't be directly integrated with API Gateway, so I'm considering placing CloudFront in front of the API and adding WAF to it. Does anyone have experience with this setup or any other recommendations? I'm also worried about potential data transfer costs if we do this.
3 Answers
Using a WAF sounds like a solid choice, but remember that Spain has been blocking many public IPs. If your CloudFront IPs are getting blocked, switching to a WAF won't directly solve that unless you're using an alternative IP range that won't get blocked. Just something to keep in mind!
I've heard that the blockage affects Cloudflare's IPs mostly, but it seems like CloudFront users are also facing weekend issues in Spain. Do you know if it's a traffic stoppage or just slow access? Sometimes, it's tricky to identify the cause when multiple factors are at play. You might want to look into reports on this.
Yeah, if traffic is being blocked on weekends, that could really hurt access for legitimate users. I would recommend checking out some news articles or social media for any updates from CloudFront regarding this issue.
Consider using HAProxy Enterprise as a cost-effective alternative. It's pretty robust for rate limiting and can handle some traffic filtering without a full WAF. Just think about whether waiting for a real WAF is worth the potential chaos that can come with misconfigured setups. I've been through that before, and it can complicate things further.
True, but if you don't use Cloudflare anymore, you might get around that issue! A WAF could still be beneficial for additional security and rate limiting.