// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-using-cloudfront-and-waf.adoc

:_mod-docs-content-type: PROCEDURE
[id="cloud-experts-using-cloudfront-and-waf-configure_amazon_cloudfront_{context}"]
= Configure Amazon CloudFront

[role="_abstract"]
Create an Amazon CloudFront distribution that directs traffic through AWS Web Application Firewall (WAF) to protect your workloads.

.Procedure
. Retrieve the newly created custom ingress controller's Network Load Balancer (NLB) hostname:
+
[source,terminal]
----
$ NLB=$(oc -n openshift-ingress get service router-cloudfront-waf \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
----

. Import your certificate into Amazon Certificate Manager, where `cert.pem` is your wildcard certificate, `fullchain.pem` is your wildcard certificate's chain and `privkey.pem` is your wildcard certificate’s private key.
+
[NOTE]
====
Regardless of what region your cluster is deployed, you must import this certificate to `us-east-1` as Amazon CloudFront is a global AWS service.
====
+
.Example
[source,terminal]
----
$ aws acm import-certificate --certificate file://cert.pem \
  --certificate-chain file://fullchain.pem \
  --private-key file://privkey.pem \
  --region us-east-1
----

. Log in to the link:https://us-east-1.console.aws.amazon.com/cloudfront/v3/home#/distributions/create[AWS console] to create a CloudFront distribution.

. Configure the CloudFront distribution by using the following information:
+
[NOTE]
====
If an option is not specified in the table below, leave the default, even if it is blank.
====
+
[cols="2",options="header"]
|===
|Option
|Value

|Origin domain
|Output from the previous command ^[a]^

|Name
|rosa-waf-ingress ^[b]^

|Viewer protocol policy
|Redirect HTTP to HTTPS

|Allowed HTTP methods
|GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE

|Cache policy
|CachingDisabled

|Origin request policy
|AllViewer

|Web Application Firewall (WAF)
|Enable security protections

|Use existing WAF configuration
|true

|Choose a web ACL
|`cloudfront-waf`

|Alternate domain name (CNAME)
|*.apps.example.com ^[c]^

|Custom SSL certificate
|Select the certificate you imported from the step above ^[d]^
|===
+
[.small]
--
a. Run `echo ${NLB}` to get the origin domain.
b. If you have multiple clusters, ensure the origin name is unique.
c. This should match the wildcard domain you used to create the custom ingress controller.
d. This should match the alternate domain name entered above.
--

. Retrieve the Amazon CloudFront Distribution endpoint:
+
[source,terminal]
----
$ aws cloudfront list-distributions --query "DistributionList.Items[?Origins.Items[?DomainName=='${NLB}']].DomainName" --output text
----

. Update the DNS of your custom wildcard domain with a CNAME to the Amazon CloudFront Distribution endpoint from the step above.
+
.Example
[source,text]
----
*.apps.example.com CNAME d1b2c3d4e5f6g7.cloudfront.net
----