AWS WAF and Shield

AWS WAF and AWS Shield protect web applications from harmful traffic. WAF inspects web requests and blocks the ones that look malicious. Shield defends against large floods of traffic that try to knock a site offline.

Imagine a shopping mall. A security guard at the entrance checks bags and turns away suspicious visitors. That guard is WAF. Crowd barriers outside keep a huge mob from rushing the doors all at once. Those barriers are Shield.

Threats These Services Address

  • SQL injection: attackers slip database commands into form fields.
  • Cross-site scripting (XSS): attackers insert harmful scripts into web pages.
  • Bot abuse: automated programs scrape content or guess passwords.
  • DDoS attacks: Distributed Denial of Service attacks flood a site with traffic until real users cannot reach it.

Where They Sit in Your Architecture

Visitors and Attackers
          |
          v
+---------------------+
| AWS Shield          |  absorbs traffic floods
+---------------------+
          |
          v
+---------------------+
| AWS WAF             |  inspects web requests
+---------------------+
          |
          v
 CloudFront / Load Balancer / API Gateway
          |
          v
    Your Application

AWS WAF in Detail

AWS WAF is a web application firewall that works at the application layer. It reads the content of each HTTP or HTTPS request. You attach WAF to a CloudFront distribution, an Application Load Balancer, an API Gateway API, or an AppSync API.

Web ACLs and Rules

A Web ACL (access control list) is the container for your protection rules. Each rule checks something about the request and takes an action: allow, block, count, or challenge.

  • IP address rules allow or block specific addresses or ranges.
  • Geographic rules restrict traffic by country.
  • String and pattern rules look for suspicious text in headers, query strings, or bodies.
  • Rate-based rules block an address that sends too many requests in a short time.

Managed Rule Groups

Writing every rule yourself takes time. AWS and security vendors publish managed rule groups that cover common attacks, known bad inputs, and bot patterns. Add a managed group to a Web ACL and receive updates without extra work.

How a Request Is Judged

Incoming request
      |
      v
Rule 1: IP on block list?        --> YES: Block
      | NO
      v
Rule 2: Too many requests?       --> YES: Block
      | NO
      v
Rule 3: SQL injection pattern?   --> YES: Block
      | NO
      v
Default action: Allow

WAF evaluates rules in priority order. The first matching rule decides the outcome.

AWS Shield in Detail

Shield protects against DDoS attacks and comes in two levels.

Shield Standard

  • It is active automatically for every AWS customer at no extra charge.
  • It defends against common network and transport layer attacks.
  • It works best when your site uses CloudFront and Route 53.

Shield Advanced

  • It is a paid service for applications with higher risk.
  • It adds detailed attack visibility and extra detection.
  • It gives access to the AWS Shield Response Team during major attacks.
  • It offers protection against certain scaling costs caused by attack traffic.

A Practical Scenario

An online store launches a sale. Bots start requesting the login page thousands of times per minute and try common passwords. The team attaches a Web ACL to the load balancer and adds a rate-based rule that blocks any address exceeding a set number of requests in five minutes. A managed rule group adds protection against known attack patterns. Real shoppers keep browsing while the bots receive blocked responses.

Test Before You Enforce

New rules can block real customers by mistake. Set a rule to count mode first. Review the logs to see which requests it would block. Switch to block mode once the results look correct.

Logging and Monitoring

  • Send WAF logs to S3, CloudWatch Logs, or Kinesis Data Firehose.
  • Review CloudWatch metrics for blocked and allowed requests.
  • Set alarms for sudden jumps in blocked traffic.

Best Practices

  • Place CloudFront in front of your application to absorb attacks near the edge.
  • Combine managed rule groups with custom rules for your own app.
  • Review rule results regularly and adjust them.
  • Keep servers in private subnets so attackers cannot bypass WAF.
  • Pair WAF with strong code practices. A firewall supports secure code and never replaces it.

WAF and Shield together give web applications layered protection against both clever requests and brute-force floods.

Previous lesson
Back to course
Next lesson