AWS WAF allows you to create your own set of rules to block most common attacks on Web Applications such as SQL injection or cross-site scripting etc. You need to specify the rules and just associate the set of rules to your AWS CloudFront Distribution. The set of rules are also called web ACL. AWS WAF also gives