CloudFront uses AWS WAF to inspect and filter application requests. Compare AWS WAF with Peakhour by reviewing your rules, logs, client traffic and the work needed to manage exceptions. CloudFront WAF guide.
What AWS WAF on CloudFront provides
You can attach a web access control list (web ACL), a list of rules, to a CloudFront distribution. CloudFront can create a recommended set of protections, or you can use an ACL configured through AWS WAF. Your team chooses the policy that applies to the distribution. AWS setup options.
AWS WAF rate-based rules group incoming requests using configured criteria and apply a limit within an evaluation window. Bot Control is a managed rule group that you can add for bot detection and handling. Include your selected rule groups in an evaluation. AWS rate-based rules and Bot Control.
AWS owns its managed rule updates. Your team owns deployed ACL settings, rule order, exceptions and rollout. Agree on who reviews the logs and approves changes when a valid request is blocked.
Where Peakhour can help
Peakhour WAF brings WAF rules, API policy, bot signals, rate limits and decision logs together. Its support guide describes OWASP Core Rule Set support, Atomicorp virtual-patching rules, warning mode and rule tuning.
Peakhour rate-limit zones support IP, header, cookie, TLS fingerprint and HTTP/2 fingerprint keys. Peakhour can count failures from server responses and use that history to limit later requests. Evaluate this workflow when login failures or API errors drive your abuse policy.
Bot management adds request behaviour, proxy information, fingerprints and route context to allow, log, challenge, rate-limit and block decisions. Teams can review the request details behind those actions.
Keep CloudFront when it fits
AWS WAF may meet your needs when your team already owns its rules, deployment workflow and monitoring. Keeping that setup preserves the processes used to review changes and respond to blocked requests.
Peakhour can run as Peakhour Edge or alongside an existing edge provider. Keeping CloudFront is an option to assess. Confirm the traffic path, point where requests are checked, client-IP handling, team that applies the rules and log delivery before a trial.
Compare using your application
- Test logins, uploads, JSON bodies, API calls and valid automated integrations.
- Review malicious requests reaching origin and valid requests blocked or challenged.
- Ask each operator to trace a decision to its rule, then create a narrow exception.
- Record configuration work, ongoing tuning and rollback steps.
AWS recommends staging tests, followed by Count mode on live traffic. Count mode records rule matches and lets matching requests continue. Peakhour's WAF guide recommends warning mode while tuning. Use a limited rollout for each service and compare the same routes over the same period. AWS testing guidance.
Contact Peakhour to review your CloudFront setup and plan a WAF evaluation.
Official sources checked: 6 November 2026.