Our online shop has been slow lately, and bot traffic may be part of the problem. We already use AWS for another service. Can we put its WAF in front of a shop hosted elsewhere, and what should we watch out for? The shop uses around 3 to 4 TB of traffic a month.
Can I put a WAF in front of an externally hosted shop?
Asked by
8s!ferrywrench_327
Answers
Yes. You can put CloudFront in front of the existing server as the origin and associate an AWS WAF web ACL with the distribution. CloudFront receives the requests, the WAF evaluates them, and allowed requests can continue to the origin.
I'd start with an IP reputation rule and a rate-based rule, then check what they would affect before blocking aggressively. Managed bot controls can add per-request costs and may catch legitimate shoppers, so pay particular attention to checkout.
Make sure people cannot simply bypass CloudFront and reach the origin directly. One option is a secret custom header added by CloudFront that the origin checks before accepting a request. Keep the value secret and configure the origin to reject requests without it.
Reply to this answer
Take a look at Cloudflare too. It may be simpler than assembling an AWS setup for this particular shop, and it has a free tier with bot mitigation features.
Compare the actual plan limits and costs against your 3 to 4 TB of monthly traffic rather than assuming a free tier will cover the whole workload. You'll also want to restrict direct access to the origin after putting the service in front.
Reply to this answer
Before buying anything, pull the access logs and group requests by path. That should give you a better idea of whether the load is mostly static files or expensive pages such as search and product filters.
Caching public static assets at the edge can reduce traffic to the server, but it won't necessarily fix a slowdown caused by uncached search requests. Be careful not to cache customer-specific pages or checkout content as public responses.
Reply to this answer
Check the current CloudFront flat-rate plans as well as regular usage-based pricing. The plans bundle caching and security features, but the right choice depends on the traffic allowance and the WAF features you need. At your traffic level, get an estimate before treating it as a free setup.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Tavrik.8g:
WAF rules can inspect request content for threats such as SQL injection and cross-site scripting, not just filter IP addresses. Check how HTTPS is terminated in the setup you choose.