Author: Nadali. Prepared using AI.
On October 30, AWS announced automatic insertion of its WAF security JavaScript SDK into HTML served by CloudFront. For business website owners, this is a reason to review settings with their contractor, rather than switch on a new option themselves.
Who can use it
A CloudFront web ACL, or protection ruleset, needs targeted Bot Control or Fraud Control ATP or ACFP. Integration defaults to on for qualifying new ACLs created in the console, but off for programmatic creation. Existing ACLs stay unchanged. Agree costs separately.
An easy-to-miss consequence
The documentation says the setting affects the entire ACL. Requests for parts of files become whole-object downloads, potentially increasing data transfer for video, audio and downloads. Script insertion is not guaranteed; old caches, Origin Shield and other documented limitations need attention. Content Security Policy must also allow the SDK to work.
The documentation recommends count mode and reviewing results before enforcing missing-token rules. Checking that the option is enabled is insufficient.
What to ask your contractor
Nadali’s editorial checklist:
- Record the domains and customer workflows affected, and who approves the change.
- Ask why the new method fits your particular website. Do not remove an existing manual integration without checking.
- Agree a test with non-sensitive data covering sign-in, checkout, video playback and file retrieval. Record expected and actual results separately.
- Agree which deviations stop rollout, who restores previous settings and who verifies recovery.
This is a proposed plan, not our completed test. An illustrative example: a store checks a product video and instruction download separately from its order form; no measured saving or outage is claimed.
Takeaway: assign a responsible specialist to check the customer’s journey. This is a website-security update, not a new AI product. Nadali has not checked AWS accounts, bills or a particular website.
Primary sources read November 2, 2026 UTC. The cover is a reused conceptual AI illustration of checking records, not the AWS interface.