Outdated AWS docs for CloudFront+WAF integration

There are several outdated articles on the AWS website about how to integrate CloudFront and WAF (including some articles that mention writing your own Lambda function to automatically update your load balancer's security group with CloudFront IP addresses).

This is the up-to-date method at the time of writing: https://aws.amazon.com/about-aws/whats-new/2022/02/amazon-cloudfront-managed-prefix-list/ . You don't need a Lambda function, you can use the prefix list mentioned in the article: you also do not need a service quota increase to do this. The managed prefix list has a set weight for counting in your security rules quota for a given security group, that comes in below the default quota.

For a step-by-step guide on enabling WAF to protect Lightsail instances, via an Application Load Balancer, CloudFront and WAF, see this page.