Check clearance before CloudFront serves a protected path.
Run the WebDecoy validator on a CloudFront viewer-request event with Lambda@Edge. Keep detection in your browser script or SDK and configure AWS WAF actions as a separate response layer.
Set up WebDecoy on AWS CloudFront
Prepare browser verification
Select the site in WebDecoy and open Enforcement → Setup. Configure browser verification and use the AWS deployment instructions and site configuration shown there.
Build the Lambda@Edge function
Use the clearance-lambda package in WebDecoy/edge. Set the site key and ingest origin in src/config.ts before building: Lambda@Edge does not support ordinary environment-variable configuration.
Attach a published version
Deploy in us-east-1, publish a function version, and associate it with the CloudFront viewer-request behavior for the traffic you want validated. Follow the repository’s IAM and deployment instructions.
Verify and start in Monitor
Verify the hostname in Enforcement → Setup. Configure protected paths, review the capabilities reported by your deployed build, and inspect Monitor activity before enabling Enforce.
Use Lambda@Edge for clearance validation
The validator checks service credentials, verified crawlers, path scope, and signed browser clearance. A request that fails the policy can receive browser verification or a 403 for a non-HTML client when enforcement is enabled.
This deployment uses Lambda@Edge, not CloudFront Functions. The validator’s cryptographic checks and runtime requirements belong in the Lambda package. AWS usage charges apply.
Confirm support for the policy you configure
AWS has no Cloudflare verified-bot signal, so the validator verifies supported crawlers through forward-confirmed reverse DNS. Do not grant access on a user-agent claim alone.
Validator capabilities differ by platform and build. The AWS validator does not yet apply Monitor paths or path exceptions inside protected paths. Review the capability status in Setup, start with narrow protected paths, and use site-wide Monitor to evaluate the rollout.
Keep AWS WAF actions separate from the validator
Lambda@Edge checks clearance on requests. The AWS WAF integration responds to detections through the WAF resources you configure. One does not automatically install or configure the other.
Use a browser detection script or application SDK for the detection evidence your policy needs. If you revoke clearance through decoy hits, put the decoy on the same origin as your pages.
Questions about AWS CloudFront
Is this a CloudFront Function?
No. Use the WebDecoy Lambda@Edge validator on the viewer-request event and attach a published function version.
Where do I set the site key?
Set the Lambda package’s src/config.ts values before building. Lambda@Edge does not use the environment variables from the Netlify installation.
Does installing Lambda@Edge connect AWS WAF?
No. AWS WAF is a separate integration with its own configuration and permissions. Verify whichever enforcement layers you choose to deploy.
Choose your platform
Start with the setup that matches where your site runs. Monitoring, request verification, and provider firewall actions are separate choices.
| Platform and setup guide | Detection | Protection |
|---|---|---|
| Netlify | Extension injects a crawler sensor at build time. | Opt-in clearance checks on protected paths; Monitor first, then Enforce. |
| Cloudflare | Managed Worker observes requests before your origin. | Worker clearance validation and separately configured WAF response actions. |
| Vercel | Log drain on Pro or Enterprise; Next.js SDK alternative. | Configure Firewall actions or SDK policy separately from the monitoring install. |
| AWS CloudFront | Browser script or SDK for detection. | Lambda@Edge clearance validator; optional AWS WAF integration. |
| WordPress | Plugin adds browser detection and decoy surfaces. | WordPress rules and form protection; an edge validator extends coverage before PHP. |
| Shopify | App embed and Web Pixel cover storefront and checkout activity. | Order tagging and risk assessments support merchant decisions; no edge validator installed by the app. |