L8. AWS WAF, Shield & DDoS Protection

Layer 7 Protection: AWS WAF

AWS WAF is a web application firewall that sits in front of CloudFront, Application Load Balancer, API Gateway, AppSync, and Cognito user pools, inspecting the content of HTTP requests rather than just the packet headers. That makes it the right tool for layer 7 (application-layer) attacks such as SQL injection and cross-site scripting, where the malicious payload is embedded in the request body, query string, or headers.

WAF protection is built from rule groups: AWS Managed Rules (curated by AWS for common threats like the OWASP Top 10), AWS Marketplace rule groups (from third-party vendors), and custom rules you write yourself for application-specific logic. A web ACL combines one or more rule groups and is attached to the resource you want to protect.

One especially exam-relevant rule type is the rate-based rule, which counts requests from each source IP over a rolling time window and automatically blocks any IP that crosses a configured threshold. This is a fast, low-effort way to blunt application-layer brute-force attempts or unsophisticated DDoS traffic without writing custom detection logic.

Layer 3/4 Protection: AWS Shield

Shield Standard is automatic and free for every AWS customer, no opt-in required. It defends against common network- and transport-layer (layer 3/4) DDoS techniques such as SYN floods and UDP reflection attacks, the kind of volumetric attacks that try to exhaust bandwidth or connection state rather than exploit application logic. Shield Advanced is a paid tier layered on top. It adds enhanced detection tuned for larger and more sophisticated attacks, 24/7 access to the AWS DDoS Response Team (DRT) for hands-on incident support during an active attack, and cost protection that credits back the scaling charges (extra EC2, ELB, or CloudFront usage) incurred while absorbing a DDoS event.

Enforcing Protection Across an Organization

Individual account owners might forget to attach a web ACL, or worse, might deliberately remove one to "fix" a false positive. AWS Firewall Manager solves this at the organization level: a designated administrator defines WAF rule sets and Shield Advanced protections once and centrally deploys and enforces them across every account and every in-scope resource in the AWS Organization. Member accounts cannot opt out of a required baseline policy, which is exactly the guarantee compliance-driven environments need.

Exam tip: If a scenario mentions a specific attack technique, application-layer techniques (SQL injection, XSS, credential stuffing via rate-based rules) point to WAF, while volumetric or protocol-flood techniques (SYN flood, UDP reflection) point to Shield. If the scenario is about guaranteeing protection across dozens of accounts without relying on each team, the answer is Firewall Manager.