DEV Community

Discussion on: How to secure and ensure the internet-facing application load balancer only allow traffic from CloudFront?

Collapse
 
jonnyshaw89 profile image
Jon Shaw

Hey Mike,

Have you actually implemented this?

We have tried this and it doesn't work. The ALB dropping the header happens before the WAF rule eveluation.

This results in all traffic being blocked.