AWS WAF adds automatic JavaScript SDK injection for CloudFront distributions

Sat, 31 Oct 2026 15:55:53 +0000

Platform/SRE — Plan: New GA capability worth evaluating this quarter: enabling automatic SDK integration on existing CloudFront web ACLs that use Bot Control (targeted), ATP, or ACFP rule groups eliminates per-application script-tag maintenance and reduces misconfiguration risk. Review your WAF web ACLs and enable the setting via Console, CLI, CDK, or CloudFormation.
CI/CD — Skip
Leader — Learn: This reduces recurring per-application engineering overhead for teams protecting many CloudFront-fronted properties with advanced WAF rule groups — useful context when assessing operational cost of the WAF managed-rule investment, but no strategic decision is required.

Aws-Waf on CuraDevOps