diff --git a/CHANGELOG.md b/CHANGELOG.md
index f474bd9..82695be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 Bugfix: Refactor md5 calculation on archive_file in codebuild child module.
 Bugfix: Re-typed AWS account number as string to avoid rounding on account numbers prepended with zeros.
+Bugfix: Fix passed WAF variable values if set to inactive.
 
 ## 0.1.0 - 19th June 2021
 
diff --git a/main.tf b/main.tf
index 00eda28..7fd9575 100644
--- a/main.tf
+++ b/main.tf
@@ -29,7 +29,7 @@ module "cloudfront" {
   depends_on = [aws_acm_certificate_validation.wordpress_site,
   module.waf]
   cloudfront_class = var.cloudfront_class
-  waf_acl_arn      = module.waf[0].waf_acl_arn
+  waf_acl_arn      = var.waf_enabled ? module.waf[0].waf_acl_arn : null
 }
 
 module "waf" {