Find CloudFront Distributions Where AWS WAF Is Not Enabled

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListDistributionsAndTenants",
      "Effect": "Allow",
      "Action": [
        "cloudfront:ListDistributions",
        "cloudfront:ListDistributionTenants",
        "wafv2:ListWebACLs"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadCloudFrontWebAcls",
      "Effect": "Allow",
      "Action": "wafv2:GetWebACL",
      "Resource": "arn:aws:wafv2:us-east-1:*:global/webacl/*/*"
    }
  ]
}

// find-cloudfront-distributions-without-waf.ts
// Lists every CloudFront distribution and reports whether an AWS WAF web ACL protects it, what the web ACL
// contains (managed rule groups, rate-based rules, count-only rules) and, for multi-tenant distributions,
// which tenants override or disable the web ACL. Report only: it changes nothing.
// Usage: npx tsx find-cloudfront-distributions-without-waf.ts
import {
  CloudFrontClient,
  paginateListDistributions,
  paginateListDistributionTenants,
} from "@aws-sdk/client-cloudfront";
import { WAFV2Client, GetWebACLCommand, ListWebACLsCommand } from "@aws-sdk/client-wafv2";
import type { DistributionSummary } from "@aws-sdk/client-cloudfront";
import type { WebACL, WebACLSummary } from "@aws-sdk/client-wafv2";

// CloudFront is global; its API and CLOUDFRONT-scoped WAF resources live in us-east-1.
const cloudfront = new CloudFrontClient({ region: "us-east-1" });
const waf = new WAFV2Client({ region: "us-east-1" });

interface Row {
  Id: string;
  Domain: string;
  Enabled: boolean;
  Verdict: string;
  WebACL: string;
  Protection: string;
}

async function listDistributions(): Promise<DistributionSummary[]> {
  const all: DistributionSummary[] = [];
  for await (const page of paginateListDistributions({ client: cloudfront }, {})) {
    all.push(...(page.DistributionList?.Items ?? []));
  }
  return all;
}

async function listWebAcls(): Promise<Map<string, WebACLSummary>> {
  const byArn = new Map<string, WebACLSummary>();
  let NextMarker: string | undefined;
  do {
    const out = await waf.send(new ListWebACLsCommand({ Scope: "CLOUDFRONT", Limit: 100, NextMarker }));
    for (const acl of out.WebACLs ?? []) if (acl.ARN) byArn.set(acl.ARN, acl);
    NextMarker = out.WebACLs?.length ? out.NextMarker : undefined;
  } while (NextMarker);
  return byArn;
}

// Summarizes what a web ACL actually does: managed groups, rate limits, and rules that only count.
function describeAcl(acl: WebACL): { text: string; countOnly: boolean } {
  const rules = acl.Rules ?? [];
  const managed: string[] = [];
  let rateBased = 0;
  let counting = 0;
  for (const rule of rules) {
    const m = rule.Statement?.ManagedRuleGroupStatement;
    if (m) managed.push(`${m.Name}${rule.OverrideAction?.Count ? " (count)" : ""}`);
    if (rule.Statement?.RateBasedStatement) rateBased++;
    if (rule.OverrideAction?.Count || rule.Action?.Count) counting++;
  }
  const fms = (acl.PreProcessFirewallManagerRuleGroups?.length ?? 0) + (acl.PostProcessFirewallManagerRuleGroups?.length ?? 0);
  const parts = [
    `${rules.length} rules`,
    managed.length ? `managed: ${managed.join(", ")}` : "no managed groups",
    `${rateBased} rate-based`,
    `default ${acl.DefaultAction?.Block ? "BLOCK" : "ALLOW"}`,
  ];
  if (fms) parts.push(`${fms} Firewall Manager groups`);
  return { text: parts.join("; "), countOnly: rules.length > 0 && counting === rules.length && fms === 0 };
}

async function tenantGaps(distributionId: string): Promise<string[]> {
  const gaps: string[] = [];
  for await (const page of paginateListDistributionTenants({ client: cloudfront }, { AssociationFilter: { DistributionId: distributionId } })) {
    for (const t of page.DistributionTenantList ?? []) {
      const custom = t.Customizations?.WebAcl;
      if (custom?.Action === "disable") gaps.push(`${t.Name}: WAF disabled`);
      else if (custom?.Action === "override") gaps.push(`${t.Name}: own web ACL`);
    }
  }
  return gaps;
}

async function main(): Promise<void> {
  const [distributions, acls] = await Promise.all([listDistributions(), listWebAcls()]);
  const details = new Map<string, { name: string; text: string; countOnly: boolean }>();
  const rows: Row[] = [];

  for (const d of distributions) {
    const webAclId = d.WebACLId ?? "";
    let verdict = "NO WAF";
    let aclName = "-";
    let protection = "-";

    if (webAclId && !webAclId.startsWith("arn:")) {
      verdict = "WAF CLASSIC";
      aclName = webAclId;
      protection = "AWS WAF Classic web ACL; migrate it to AWS WAF";
    } else if (webAclId) {
      if (!details.has(webAclId)) {
        const summary = acls.get(webAclId);
        const out = summary?.Id && summary.Name
          ? await waf.send(new GetWebACLCommand({ Scope: "CLOUDFRONT", Id: summary.Id, Name: summary.Name })).catch(() => undefined)
          : undefined;
        const described = out?.WebACL ? describeAcl(out.WebACL) : { text: "web ACL not readable", countOnly: false };
        details.set(webAclId, { name: summary?.Name ?? webAclId, ...described });
      }
      const info = details.get(webAclId)!;
      verdict = info.countOnly ? "COUNT ONLY" : "PROTECTED";
      aclName = info.name;
      protection = info.text;
    }

    if (d.ConnectionMode === "tenant-only") {
      const gaps = await tenantGaps(d.Id ?? "");
      if (gaps.length) protection += ` | tenants: ${gaps.join(", ")}`;
    }
    rows.push({ Id: d.Id ?? "?", Domain: d.Aliases?.Items?.[0] ?? d.DomainName ?? "?", Enabled: d.Enabled ?? false, Verdict: verdict, WebACL: aclName, Protection: protection });
  }

  const order = ["NO WAF", "WAF CLASSIC", "COUNT ONLY", "PROTECTED"];
  rows.sort((a, b) => order.indexOf(a.Verdict) - order.indexOf(b.Verdict));
  console.table(rows);

  const unprotected = rows.filter((r) => r.Enabled && r.Verdict !== "PROTECTED");
  const unused = [...acls.values()].filter((a) => a.ARN && !distributions.some((d) => d.WebACLId === a.ARN));
  console.log(`${unprotected.length} of ${rows.length} enabled distributions have no blocking AWS WAF web ACL.`);
  if (unused.length) console.log(`CLOUDFRONT web ACLs not attached to any distribution: ${unused.map((a) => a.Name).join(", ")}`);
  if (unprotected.length) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-cloudfront @aws-sdk/client-wafv2
npm install --save-dev tsx typescript

AWS_PROFILE=security-audit npx tsx find-cloudfront-distributions-without-waf.ts

┌─────────┬──────────────────┬──────────────────────┬─────────┬───────────────┬────────────────────────────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ (index) │ Id               │ Domain               │ Enabled │ Verdict       │ WebACL                                 │ Protection                                                                                                                                                 │
├─────────┼──────────────────┼──────────────────────┼─────────┼───────────────┼────────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 0       │ 'E2QWRUHAPOMQZL' │ 'docs.example.com'   │ true    │ 'NO WAF'      │ '-'                                    │ '-'                                                                                                                                                        │
│ 1       │ 'E1KSDF8ZL3MNOP' │ 'legacy.example.com' │ true    │ 'WAF CLASSIC' │ '473e64fd-f30b-4765-81a0-62ad96dd167a' │ 'AWS WAF Classic web ACL; migrate it to AWS WAF'                                                                                                           │
│ 2       │ 'E3ABCD1234EFGH' │ 'shop.example.com'   │ true    │ 'COUNT ONLY'  │ 'shop-edge-acl'                        │ '2 rules; managed: AWSManagedRulesCommonRuleSet (count), AWSManagedRulesKnownBadInputsRuleSet (count); 0 rate-based; default ALLOW'                        │
│ 3       │ 'E9ZYXW7654VUTS' │ 'www.example.com'    │ true    │ 'PROTECTED'   │ 'web-edge-acl'                         │ '4 rules; managed: AWSManagedRulesCommonRuleSet, AWSManagedRulesKnownBadInputsRuleSet, AWSManagedRulesAmazonIpReputationList; 1 rate-based; default ALLOW' │
└─────────┴──────────────────┴──────────────────────┴─────────┴───────────────┴────────────────────────────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
3 of 4 enabled distributions have no blocking AWS WAF web ACL.
CLOUDFRONT web ACLs not attached to any distribution: old-marketing-acl