Hey everyone, been doing a deep dive on WAF/CDN solutions for our serverless-first environment on AWS. We're all-in on cloud-native: API Gateway, Lambda, Fargate, and S3 for static assets. I'm curious if anyone here is running Imperva (Cloud WAF/API Security) in a similar, fully cloud-native stack?
I've seen it work well in hybrid or data-center-led models, but I'm trying to picture the day-to-day in a setup where there's no fixed origin IP for things like Lambda URLs or where auto-scaling is extreme. How are you handling origin configuration and IP allow-listing? The classic "allow only Imperva's IP ranges" in your security groups becomes tricky when your origin is a public API Gateway endpoint or a CloudFront distribution.
Also, from a security perspective, I'm always thinking about IAM and least privilege. If using their cloud offering, how are you managing integration? I've seen some... creative... but scary IAM policies when folks try to automate things. For example, a policy that's far too permissive just to get a Terraform module working:
```json
{
"Effect": "Allow",
"Action": ["s3:*", "cloudfront:*"],
"Resource": "*"
}
```
Yikes, right? 😬
Specific things I'd love to hear about:
* **Origin Setup:** Are you pointing Imperva at your API Gateway/CloudFront, or directly at internal ALBs/NLB? Any issues with header insertion or TLS between layers?
* **Security Posture:** How do you handle DDoS layers? Does it sit *before* AWS Shield, or do you rely on it exclusively?
* **Compliance & Logging:** Are you feeding WAF logs directly into your cloud SIEM (e.g., a Kinesis -> S3 -> Athena pipeline)? How's the integration?
* **Pitfalls:** Any gotchas with API security for serverless functions where the "path" might be dynamic?
Just trying to do some real-world threat modeling here. A solution might be feature-rich but add complexity that introduces new misconfiguration risks. Appreciate any insights!
security by default