AWS waf: Add Akamai to CDNs auto-recognized for forwarded IP handling
Summary
The AWS WAF forwarded IP address documentation now lists Akamai alongside Amazon CloudFront, Cloudflare, and Fastly as third-party CDNs whose traffic the Bot Control and Anti-DDoS managed rule groups automatically recognize, transparently using the upstream client IP header.
Security assessment
The change documents that AWS WAF managed rule groups now trust Akamai's IP ranges and use the upstream client IP header, which is security-relevant because correct forwarded-IP handling prevents IP spoofing and ensures bot/DDoS rules evaluate the true client IP. It is a documentation update rather than a fix for a specific vulnerability.
Evidence
+For requests that arrive at AWS WAF through a third-party CDN, the Bot Control managed rule group and the Anti-DDoS managed rule group automatically recognize traffic that originates from the IP ranges of Amazon CloudFront, Akamai, Cloudflare, and Fastly.
Diff
diff --git a/waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md b/waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md index 18111e1..c0025e5 100644 --- a//waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md +++ b//waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md @@ -53 +53 @@ The Bot Control managed rule group verifies bots using the IP addresses from AWS -For requests that arrive at AWS WAF through a third-party CDN, the Bot Control managed rule group and the Anti-DDoS managed rule group automatically recognize traffic that originates from the IP ranges of Amazon CloudFront, Cloudflare, and Fastly. When the rule groups detect a request from one of these CDNs, they transparently use the originating client IP from the upstream CDN's standard client IP header (for example, the `Fastly-Client-IP` header for Fastly). You don't need to configure forwarded IP addresses on these rule groups for these CDNs to work correctly. For other rule statements that use IP addresses, such as your custom IP set match, geo match, ASN match, and rate-based rules, you still need to specify a forwarded IP configuration if you want them to evaluate the upstream client IP instead of the CDN's IP. +For requests that arrive at AWS WAF through a third-party CDN, the Bot Control managed rule group and the Anti-DDoS managed rule group automatically recognize traffic that originates from the IP ranges of Amazon CloudFront, Akamai, Cloudflare, and Fastly. When the rule groups detect a request from one of these CDNs, they transparently use the originating client IP from the upstream CDN's standard client IP header (for example, the `Fastly-Client-IP` header for Fastly). You don't need to configure forwarded IP addresses on these rule groups for these CDNs to work correctly. For other rule statements that use IP addresses, such as your custom IP set match, geo match, ASN match, and rate-based rules, you still need to specify a forwarded IP configuration if you want them to evaluate the upstream client IP instead of the CDN's IP.