CDN or WAF deployed with DDoS protection, geo-blocking, rate limiting, and bot detection

An application served without CDN or WAF absorbs every request directly — a DDoS attack that exceeds origin capacity takes down the service entirely, and malicious bots, scrapers, and credential stuffers operate without any filtering layer. NIST 800-53 SC-5 requires DoS protection; SI-3 requires malicious code protection at entry points. CIS AWS 2.5 requires WAF attachment to CloudFront distributions. Geo-blocking and bot detection are particularly relevant for AI-built projects whose attack surfaces are often discovered quickly via passive DNS enumeration.

Deploy a CDN with WAF in front of your origin. For AWS, attach WAF to CloudFront in your IaC (terraform/cloudfront.tf):

resource "aws_wafv2_web_acl" "main" {
  name  = "app-waf"
  scope = "CLOUDFRONT"
  default_action { allow {} }

  rule {
    name     = "RateLimitRule"
    priority = 1
    action { block {} }
    statement {
      rate_based_statement {
        limit              = 1000
        aggregate_key_type = "IP"
      }
    }
    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimitRule"
    }
  }
}

For Cloudflare users, enable DDoS protection (automatic), create rate limiting rules, enable bot fight mode, and optionally add geo-blocking via Firewall Rules — all configurable without infrastructure changes.