I have an S3 hosted site behind a Cloudfront and WAF. I set up a Cognito hosted UI with a custom domain (auth.example.com where example.com is my site). Cognito generates a Cloudfront distribution that is aliased in Route 53 to my domain but doesn't appear listed as an option under Add Resources to WAF ACL. As a result I can't add the hosted UI pages to my WAF.
How do I get the hosted UI behind the WAF ?