AWS CloudFront with WAF and mTLS

A new official CloudFront Edge blueprint lets you secure public endpoints for services in your AWS environment with AWS WAF and CloudFront viewer mTLS. It deploys a CloudFront distribution in front of Ryvn's origin, so CloudFront handles public traffic instead of Ryvn's default edge proxy.

The blueprint can set up AWS WAF for the distribution, or attach a WAF configuration you already have. With a new WAF, you choose which AWS managed rules to enable for common web attacks and whether to restrict access to trusted IPs. Viewer mTLS uses your own CA to verify client certificates at CloudFront before traffic reaches your service.