Connecting a Fastly account to your corp
IMPORTANT: This guide only applies to Next-Gen WAF customers who cannot access the WAF in the Fastly control panel.
When you connect a Fastly account to your Next-Gen WAF corp, you gain access to the Next-Gen WAF and through the Fastly control panel and Fastly API while retaining access to the Next-Gen WAF control panel and Next-Gen WAF API. If purchased, Bot Management also becomes available through both control panels and APIs. Your WAF configuration settings and user accounts are shared across both control panels, so any changes you make will be immediately reflected in both experiences.
Limitations and considerations
The option to connect a Fastly account to your corp is not available if you have:
- an Edge WAF deployment that protects a CDN service with mutual TLS (mTLS) enabled.
- CDN services from multiple Fastly accounts that are protected by a single corp.
To link a corp to a Fastly account, you must be an Owner of the corp and a Superuser of the Fastly account that you're linking. If you do not have a Fastly account, you need to create one.
How it works
Start by logging in to the Next-Gen WAF control panel and selecting the Fastly account that you'd like to connect to your corp. This action is permanent and cannot be changed. Next, if you have an Edge WAF deployment, transition its management to the Fastly control panel or the Fastly Terraform provider.
Initial user provisioning
After you've connected your corp to a Fastly account, Fastly adds your corp users to the linked Fastly account and assigns them equivalent security roles (as shown in the following table). This means your users will be able to access the Next-Gen WAF and (if purchased) Bot Management through both control panels and APIs.
| Signal Sciences account role | Fastly account role |
|---|---|
| Owner | Next-Gen WAF Owner |
| Admin | Next-Gen WAF Admin |
| User | Next-Gen WAF User |
| Observer | Next-Gen WAF Observer |
Corp users who are new to the Fastly control panel can log in to https://manage.fastly.com using their https://dashboard.signalsciences.net credentials. Users who already had access to both control panels with the same email address will experience no credential changes.
Managing shared configurations
Your WAF configuration settings and user accounts are accessible across both the Next-Gen WAF and Fastly control panels, with changes immediately applied to both.
However, the Fastly control panel provides more configuration options for the following signals:
- Login Attempt
- Login Success
- Login Failure
- Registration Attempt
- Registration Success
- Registration Failure
This means that if you use the Fastly control panel to configure them, the changes may not be visible in the Next-Gen WAF control panel. If you use the Next-Gen WAF control panel to configure these signals, your changes will override whatever is displayed in the Fastly control panel. The Fastly control panel will always represent the latest configuration.
Managing Edge WAF deployments
After you've connected your corp to a Fastly account and transitioned the management of your Edge WAF deployments to the Fastly control panel, the control panel and API you use to create and manage Edge WAF deployments may change:
- Compute services: only use the Fastly control panel and API going forward.
- CDN services without mutual TLS (mTLS): only use the Fastly control panel and API going forward.
- CDN services with mTLS: keep using the Next-Gen WAF API.
Linking a Fastly account
Linking your Next-Gen WAF corp to a Fastly account is a one-time action that permanently connects the corp to the Fastly account. To link your corp to a Fastly account, complete the following steps:
- Log in to the Next-Gen WAF control panel.
- In the banner at the top of the Corp Overview dashboard, click the Link account link.
- Click Link account.
- Check the box to confirm that you understand that the link will be permanent and cannot be changed and click Continue to account selection.
- From the Fastly account menu, select the Fastly account that you'd like to link to your corp.
- In the Account name field, enter the name of the Fastly account to confirm that you made the correct selection.
- Click Confirm and link account. The corp and account are permanently linked and Fastly begins copying all corp users to the linked Fastly account. Upon completion, Fastly emails all superusers of the Fastly account.
- (Optional) If single sign-on (SSO) is enabled for your Fastly account, add the email addresses for the corp users to your identity provider (IdP).
Transition Edge WAF management
If you have an Edge WAF deployment for a Compute service or a CDN service without mutual TLS (mTLS), you need to transition its management to the Fastly control panel or the Fastly Terraform provider.
- Non-Terraform migration
- Terraform migration
To transition management of your Edge WAF deployment from the Next-Gen WAF API to the Fastly control panel, complete the following steps:
- Log in to the Fastly control panel.
- From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
Click Service configuration and then Security.
Fill out the following deployment settings on the Next-Gen WAF card:
- From the Workspace menu, select the workspace that you want to link to the service. If your account only has one workspace, this field is read-only.
- (CDN services only) In the % of traffic field, enter the percentage of traffic that you want the Next-Gen WAF to inspect. When set to
100, all traffic to your service is inspected. When the value is less than 100, a random sample of the specified percentage is inspected.
Click the Next-Gen WAF switch to the On position.
In the confirmation window, click Update all versions.
