Is Content Security Policy (CSP) available for AWS ALB or WAF?

I have done a security vulnerability scan against my hosted site behind ALB with WAF integration. The scan reported the following:

Content Security Policy (CSP) Missing csp_no_policy_v2

Recommendation:

• Implement a Content Security Policy (CSP) by configuring HTTP headers on your web server.

I have been poking around the ALB Attribute settings and WAF rules but can't seem to find where I can add the CSP HTTP header configuration. Any help is greatly appreciated.

Thank You