Amazon WAF + Amazon API Gateway

Question

I was wondering - with both AWS WAF and AWS API Gateway, what are the best practices for choosing which resources to shield with them for max security?

Or is it simply:

1. For all static content - use WAF over CloudFront
2. For all REST api calls - secure it with API Gateway
3. For everything else - secure it with WAF

Kind regards,

Answer 1

I've been liking placing Cloudfront in front of API Gateway so that I can take advantage of WAF globally. Unfortunately you do pay for 2 Cloudfront requests with this solution (api gateway uses cloudfront behind the scenes).

AWS Shield Advanced is also pretty fantastic (and new) -- once again -- you can only leverage it via Cloudfront currently so you'd need to proxy API Gateway to utilize it.