Retrofitting CloudFront + WAF onto an Existing Reverse-Proxy Origin: Practical Patterns
An implementation log of migrating a group of services running on Docker + Traefik, with no downtime, to a CloudFront + WAF-protected setup. I cover naming for the origin-only subdomain, pitfalls with shared Security Groups, the case for starting WAF in COUNT mode, cache design for SPARQL/API traffic, and other recurring decision points.
awscloudfrontwafterraform