amazon web services - AWS Cloudfront (with WAF) + API Gateway: how to force access through Cloudfront? -

i want put waf in front of api gateway, , (little) info find possible manually putting cloudfront distribution waf enabled, in front of apig. it's bit of shame, since apig supports custom domains natively, should work.

now make solution secure rather obscure, want enforce apis can accessed through cloudfront distro. best option this?

• i hoping able use 'origin access identities' similar s3, don't see how that.
• if assign iam user (or role?) cloudfront distro, use apig iam feature, don't see how can done.
• i require api key in apig, , pass origin custom header cloudfront. work, long don't want use api keys other purpose, i'm not entirely happy that.
• a dummy (!) custom authorizer used, token validation expression checking secret passed origin custom header cloudfront. should work, it's more flexible, bit dirty... or not?

any better ideas? or perhaps "the right way" exists overlooked it?

i api gateway.

unfortunately, best solution have of is, inject origin custom header in cloudfront , validate in custom authorizer (option 4 in question).

we aware of limitation , not-so-great workaround. looking provide better waf integration in future, not have eta.