I have two webistes
www.mysite.com. -->hosted on s3
, served via Cloudfront static single page App.Then I have
api.mysite.com
, which the front end uses.
My company is using WAF solution
from thirdparty and current monolith applications are protected by it.
For the new site , i have put api.mysite.com
behind WAF but i am not sure if i need to put static site behind WAF as well or not?
This is mostly regarding preventing site against DDOS attacks or bots etc, we had many attacks before, so I want to make sure i do the thing right way.