We run a small online shop that has become slow over the past few days because of heavy bot traffic and a large number of requests. Our provider is preparing an offer to secure and protect the shop, but we already use AWS for another service and are considering AWS WAF as an alternative. Can CloudFront and WAF sit in front of our externally hosted shop, filter traffic with ACLs and rate limits, and forward only approved requests to the existing server? What should we consider regarding HTTPS, caching, origin protection, bot management, and cost?
4 Answers
The usual AWS setup is CloudFront in front of the existing server, with AWS WAF attached to the CloudFront distribution. Use rate-based rules, IP reputation lists, and carefully scoped bot protections to reduce abusive traffic. Caching public pages and static files at the edge can also reduce load and improve response times. Avoid enabling aggressive bot controls immediately, since they can occasionally challenge or block legitimate shoppers during checkout.
Before choosing a service, inspect the access logs and group requests by URL. If the abuse is concentrated on search, filtering, login, or other dynamic endpoints, caching images alone will not prevent the application from being overloaded. Rate-limit those paths and consider application-level fixes as well. Cloudflare can provide a simpler alternative, especially if managing several terabytes of monthly traffic makes AWS request and data-transfer costs difficult to predict.
Make sure the origin cannot be reached directly. Otherwise bots can simply bypass CloudFront and WAF by targeting the server's public IP. A common approach is to add a secret custom header from CloudFront and configure the origin to accept requests only when that header is present. Ideally, also restrict network access to CloudFront where possible.
WAF needs to inspect decrypted HTTP traffic. With HTTPS, the certificate is normally installed on CloudFront, where TLS terminates before WAF evaluates the request. CloudFront can then connect to the external origin over HTTPS again, so the origin still receives encrypted traffic. Plan for certificate deployment and renewal in both places, and verify that the shop works correctly behind a reverse proxy.
Thanks for mentioning the traffic volume. We are currently seeing roughly 3–4 TB per month, so I will compare the pricing and operational effort of CloudFront/WAF with Cloudflare rather than assuming the shop qualifies as low traffic.