AWS amplify documentation change

Service: amplify · 2025-05-03 · Documentation low

File: amplify/latest/userguide/getting-started-using-waf.md

Summary

Reinforced requirement for Global Region web ACLs in multiple sections and emphasized incompatibility with regional ACLs.

Security assessment

This update improves documentation for proper security feature setup but lacks evidence of addressing a specific security vulnerability. It ensures users configure WAF correctly without citing past security incidents.

Diff

diff --git a/amplify/latest/userguide/getting-started-using-waf.md b/amplify/latest/userguide/getting-started-using-waf.md
index c2f6801e3..c3b3b239b 100644
--- a//amplify/latest/userguide/getting-started-using-waf.md
+++ b//amplify/latest/userguide/getting-started-using-waf.md
@@ -11 +11 @@ You can enable AWS WAF protections for an Amplify app either in the Amplify cons
-  * **AWS WAF console** — Use a preconfigured web ACL that you create in the AWS WAF console or by using the AWS WAF APIs. For getting started instructions, see [Setting up AWS WAF and its components](https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.html) in the _AWS WAF Developer Guide_.
+  * **AWS WAF console** — Use a preconfigured web ACL that you create in the AWS WAF console or by using the AWS WAF APIs. You must create web ACLs that you want to associate with an Amplify app in the Global (CloudFront) Region. Regional web ACLs might already exist in your AWS account, but they are not compatible with Amplify. For getting started instructions, see [Setting up AWS WAF and its components](https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.html) in the _AWS WAF Developer Guide_.
@@ -64 +64 @@ The following screenshot demonstrates how to enable a new AWS WAF configuration
-       2. Select a saved configuration from the list of web ACLs in AWS WAF in your AWS account.
+       2. Select a saved configuration from the list of web ACLs in AWS WAF in your AWS account. The web ACL that you associate with your Amplify app must be created in the Global (CloudFront) Region. Regional web ACLs might already exist in your AWS account, but they are not compatible with Amplify.