Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Resources that you can protect with Amazon WAF

You can use an Amazon WAF web ACL to protect global or regional resource types. You do this by associating the web ACL with the resources that you want to protect. The web ACL and any Amazon WAF resources that it uses must be located in the Region where the associated resource is located. For Amazon CloudFront distributions, this is set to US East (N. Virginia).

Amazon CloudFront distributions

You can associate an Amazon WAF web ACL with a CloudFront distribution using the Amazon WAF console or APIs. You can also associate a web ACL with a CloudFront distribution when you create or update the distribution itself. To configure an association in Amazon CloudFormation, you must use the CloudFront distribution configuration. For information about Amazon CloudFront, see Using Amazon WAF to Control Access to Your Content in the Amazon CloudFront Developer Guide.

Amazon WAF is available globally for CloudFront distributions, but you must use the Region US East (N. Virginia) to create your web ACL and any resources used in the web ACL, such as rule groups, IP sets, and regex pattern sets. Some interfaces offer a region choice of "Global (CloudFront)". Choosing this is identical to choosing Region US East (N. Virginia) or "us-east-1".

Regional resources

You can protect regional resources in all Regions where Amazon WAF is available. You can see the list at Amazon WAF endpoints and quotas in the Amazon Web Services General Reference.

You can use Amazon WAF to protect the following regional resource types:

You can only associate a web ACL to an Application Load Balancer that's within Amazon Web Services Regions. For example, you cannot associate a web ACL to an Application Load Balancer that's on Amazon Outposts.

The web ACL and any other Amazon WAF resources that it uses must be located in the same Region as the protected resources. When monitoring and managing web requests for a protected regional resource, Amazon WAF keeps all data in the same Region as the protected resource.

Restrictions on multiple resource associations

You can associate a single web ACL with one or more Amazon resources, with the following restrictions: