CloudFront can add the browser script at the edge

AWS announced on October 30 that CloudFront can insert the AWS WAF JavaScript SDK into eligible HTML responses. The SDK collects browser signals used by the targeted tier of Bot Control and by the account-takeover and account-creation Fraud Control rule groups. Automatic insertion removes the need to place and maintain the script tag in each application.

The feature applies only to global CloudFront web ACLs containing at least one qualifying managed rule group. It does not support regional WAF resources, the common Bot Control inspection tier, the CAPTCHA JavaScript API or mobile SDKs. AWS says the insertion feature has no additional charge; customers still need to account for the managed rule groups, WAF requests and CloudFront services they use.

New console ACLs and existing configurations behave differently

For a new qualifying CloudFront web ACL created in the AWS console, automatic integration starts enabled by default. Programmatic creation leaves it off unless the configuration includes the new setting. Existing ACLs and ACLs that later gain a qualifying rule group are unchanged, so administrators must enable the feature deliberately.

AWS recommends confirming both the inserted script and the browser token before enforcing rules that depend on a token. There is no metric or log field that proves CloudFront inserted the tag into a particular response, which makes direct browser checks and a count-first rule rollout important.

Some delivery patterns still require direct integration

AWS documents gaps for some uncached high-rate traffic, Origin Shield, Lambda@Edge origin events and embedded points of presence. Content security policies must allow the WAF domain, and strict-dynamic policies that depend on nonces or hashes require a manual tag. The setting also removes range headers and returns whole objects, which can increase transfer for video, audio and resumable downloads.

Insertion is limited to successful, uncompressed HTML with a detectable head element. It fails open: when CloudFront cannot add the tag, it returns the origin response rather than blocking it. Teams should therefore test representative cached and uncached paths before treating automatic insertion as a complete replacement for application-level integration. AWS published no feature-specific geographic rollout because the setting is tied to CloudFront-scoped WAF ACLs.