AwsSolutions-CFR2
CloudFront distribution has no WAF
What it means
The distribution is not associated with an AWS WAF web ACL.
Why it matters
CloudFront is the edge of your application, and it is where volumetric abuse arrives first. Without a web ACL there is no rate limiting before requests reach the origin, so a flood costs origin compute rather than an edge evaluation.
How to fix it
Associate a WAFv2 web ACL with the distribution. A single rate-based rule is a reasonable starting point; managed rule groups can come later.
See it fail
This stack trips AwsSolutions-CFR2 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.
Open “CloudFront distribution allowing HTTP” in the playground →