CLOUDFRONT WAF RECOMMENDATIONS (REDDIT THREAD)

Summary from the TLDR InfoSec newsletter

A Reddit user experienced a $9,000 bill due to a CloudFront WAF bypass. A comment presented a list of suggestions to improve WAF usage such as blocking the AWSManagedRulesAmazonIPReputationList list, setting rate limits at various levels with COUNT actions to determine baselines to block, restricting access to the S3 bucket, and blocking geos that customers don't reside in. The comment also suggested using AWS Shield Advanced, which gives access to the Shield Response Team and has a WAF allowance included in its $3,000/month cost.