AWS DDoS & Edge Protection Architecture — Overview
Edge protection is tested across SCS-C03 (Domain 3: Infrastructure Security) and SAP-C02. The architecture combines CloudFront (CDN/edge), AWS WAF (Layer 7 rules), AWS Shield (DDoS mitigation), and AWS Firewall Manager (centralized management). This post covers the full defense stack, rule design, and automated response patterns.
AWS WAF — Rule Types & Strategy
| Rule Type | What It Does | Use Case |
|---|---|---|
| Rate-based | Counts requests per IP in 5-min window; blocks when exceeds threshold | Brute force prevention, DDoS mitigation, API abuse |
| IP Set | Allow/Block specific IP addresses or CIDR ranges | Threat intelligence feeds, allowlisting corporate IPs |
| Geo Match | Match by country of origin | Block countries, route to regional content |
| SQL Injection | Detects SQLi patterns in query strings, body, headers | OWASP Top 10 — SQL injection prevention |
| XSS | Detects cross-site scripting patterns | OWASP Top 10 — XSS prevention |
| Size Constraint | Block requests exceeding size limits | Prevent large payload attacks |
| Managed Rule Groups | Pre-built rules by AWS or marketplace sellers | AWSManagedRulesCommonRuleSet (OWASP), BotControl, ATPProtection |
| Custom Response | Return custom HTTP response (403, 429) with custom body | Friendly error pages, CAPTCHA challenges |
AWS Shield — Standard vs Advanced
| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Cost | Free (included with all AWS accounts) | $3,000/month + data transfer fees |
| Protection | Layer 3/4 (network/transport) | Layer 3/4/7 (+ application layer) |
| DRT Access | No | Yes — AWS DDoS Response Team assists during attacks |
| Cost Protection | No | Refund for scaling costs caused by DDoS attacks |
| Resources Protected | All (automatic) | CloudFront, ALB, NLB, EIP, Global Accelerator, Route 53 |
| Health-based Detection | No | Yes — uses Route 53 health checks to detect application-layer attacks |
| Automatic L7 Mitigation | No | Yes — auto-creates WAF rules during L7 attacks |
AWS Firewall Manager — Centralized Policy
- Purpose: Deploy and manage security rules across ALL accounts in an Organization from a single admin account
- Manages: WAF rules, Shield Advanced protections, Security Groups, Network Firewall rules, Route 53 Resolver DNS Firewall
- Auto-remediation: Automatically applies policies to new resources/accounts (no manual setup per account)
- Prerequisite: AWS Organizations + Config enabled in all accounts
- Exam key: “Deploy WAF rules consistently across all accounts” → Firewall Manager
Protection Patterns by Attack Type
| Attack | Layer | Mitigation |
|---|---|---|
| SYN Flood | L3/4 | Shield Standard (automatic). Put behind CloudFront/ALB. |
| UDP Reflection/Amplification | L3/4 | Shield Standard. Security groups (block UDP if not needed). |
| DNS Amplification | L3/4 | Route 53 (inherently scalable). Shield protects Route 53. |
| HTTP Flood | L7 | WAF rate-based rules. CloudFront caching. Shield Advanced auto-mitigation. |
| Slowloris | L7 | ALB (handles connection pooling). CloudFront times out slow connections. |
| SQL Injection | L7 | WAF SQLi rule set. Input validation at application. |
| Bot/Scraper | L7 | WAF Bot Control (managed rule). CAPTCHA challenges. Client fingerprinting. |
Best Practice Architecture
- Always front with CloudFront: Absorbs volumetric attacks at edge, hides origin IP, enables WAF without additional latency
- Origin protection: Security group on ALB allows only CloudFront managed prefix list IPs + custom origin header validation
- WAF on CloudFront: Deploy WAF at CloudFront (not ALB) — blocks attacks at the edge before they reach your region
- Rate limiting at multiple levels: WAF rate rules (per-IP), API Gateway throttling (per-API key), application-level
- Auto-scaling behind protection: Even with DDoS protection, ensure ASG/ALB can handle legitimate traffic spikes
Exam Tips
| Exam | Key Points |
|---|---|
| SCS-C03 | “L3/L4 DDoS” → Shield Standard (free, automatic). “L7 DDoS + cost protection + DRT” → Shield Advanced. “Block SQL injection” → WAF SQLi rule. “Rate limit per IP” → WAF rate-based rule. “Deploy WAF across all accounts” → Firewall Manager. “Hide origin from internet” → CloudFront + SG restricting to CF IPs. “OWASP Top 10” → AWS Managed Rules Common Rule Set. “Automatic L7 mitigation” → Shield Advanced. |
AWS Certification Exam Practice Questions
Question 1:
A company’s web application behind an ALB is experiencing an HTTP flood attack (thousands of requests per second from distributed IPs targeting the /login endpoint). Shield Standard is not mitigating it. What combination provides the fastest protection?
- Enable Shield Advanced on the ALB and wait for automatic mitigation
- Add a WAF rate-based rule on the ALB limiting requests to /login per IP, and deploy CloudFront in front of the ALB
- Increase ALB capacity and add more EC2 instances behind the ASG
- Block all international traffic using Security Group rules
Show Answer
Answer: B — Shield Standard only handles L3/L4 attacks, not L7 HTTP floods. A WAF rate-based rule (e.g., 100 requests per 5 minutes per IP to /login) blocks excessive requesters. CloudFront absorbs the volumetric load at the edge before it reaches the ALB. Shield Advanced (A) would help long-term but takes time to onboard. Scaling (C) increases cost without solving the attack. SG rules (D) can’t block distributed IPs easily.
Question 2:
A company needs to deploy identical WAF rules (OWASP protections + rate limiting) across 30 AWS accounts in their Organization. When new accounts are added, the rules must be automatically applied. Which approach requires the LEAST ongoing effort?
- Create a CloudFormation StackSet that deploys WAF WebACLs to all accounts
- Use AWS Firewall Manager with a WAF policy applied to the Organization
- Create a central Lambda function that deploys WAF rules to each account via cross-account roles
- Document the WAF rules and require each account team to implement them manually
Show Answer
Answer: B — Firewall Manager automatically applies WAF policies to all accounts in the Organization. When new accounts are added, policies are automatically applied. When new resources (ALBs, CloudFront distributions) are created, WAF is automatically associated. CloudFormation StackSets (A) work but require manual triggering for new accounts/resources.
Question 3:
A company wants to ensure their ALB origin is NEVER directly accessible from the internet — all traffic must flow through CloudFront. They also want to verify that requests actually came from their CloudFront distribution (not someone else’s). Which controls achieve this?
- ALB security group allowing only CloudFront managed prefix list + custom origin header in CloudFront that ALB validates
- Private ALB in a private subnet with no internet gateway
- WAF on ALB blocking requests without CloudFront headers
- Shield Advanced protecting the ALB directly
Show Answer
Answer: A — Two layers: (1) Security group restricts ALB ingress to only the CloudFront managed prefix list IPs (no direct internet access). (2) CloudFront adds a custom origin header (secret value), ALB or application validates it — ensures the request came from YOUR distribution (not any random CloudFront distribution). Private ALB (B) wouldn’t receive CloudFront traffic either. WAF (C) alone doesn’t prevent direct IP access.
Question 4:
During a DDoS attack, a company’s Auto Scaling group scales up significantly, tripling their EC2 and data transfer costs. They have Shield Advanced. After the attack, how can they recover these costs?
- File a support ticket requesting a general AWS credit
- Request DDoS cost protection credit through Shield Advanced — AWS refunds scaling costs attributed to the DDoS attack
- Shield Advanced automatically credits the account without any action
- Costs cannot be recovered; Shield Advanced only prevents future attacks
Show Answer
Answer: B — Shield Advanced includes DDoS cost protection. After an attack, you can request service credits for scaling charges (EC2, ELB, CloudFront, Route 53, Global Accelerator) caused by the DDoS event. You must file a request within 15 days of the billing cycle. It’s not automatic (C is wrong) — you must submit a request with evidence that the scaling was DDoS-related.
Question 5:
A security engineer needs to block requests from a specific list of 10,000 malicious IPs updated daily by a threat intelligence feed. The block must apply to CloudFront distributions across all accounts. What is the most operationally efficient solution?
- Manually update Security Groups daily in each account
- Create a WAF IP set, use a Lambda function to update it daily from the threat feed, deploy via Firewall Manager across all accounts
- Use Network Firewall with stateful rules in each VPC
- Configure Route 53 to not resolve DNS for those IPs
Show Answer
Answer: B — WAF IP sets can hold up to 10,000 IPs. Lambda (triggered daily by EventBridge) fetches the threat feed and updates the IP set via the WAF API. Firewall Manager deploys the WAF policy with this IP set rule across all accounts/distributions automatically. Security Groups (A) have a 60-rule limit and don’t apply to CloudFront. Network Firewall (C) doesn’t protect CloudFront. Route 53 (D) doesn’t block by source IP.
Related Posts
- Global Traffic Management – Route 53, GA & CloudFront
- Security Services Architecture
- IAM Security Architecture
- Centralized Logging Architecture
- Data Encryption Architecture
References
- AWS WAF Developer Guide
- AWS Shield Developer Guide
- Three Most Important WAF Rate-Based Rules — AWS Security Blog
- AWS Firewall Manager Guide
Frequently Asked Questions
Do I need Shield Advanced if I have WAF?
Shield Standard (free) handles L3/L4 DDoS automatically. WAF handles L7 (application) attacks with rules you define. Shield Advanced adds: L7 automatic mitigation, DRT team access during attacks, cost protection (refund for DDoS-caused scaling), and near real-time visibility. For most applications, Shield Standard + WAF is sufficient. Shield Advanced is for high-profile targets needing DRT support and cost protection.
Where should I deploy WAF — on CloudFront or ALB?
Deploy WAF on CloudFront when possible. Attacks are blocked at the edge (closer to attacker, further from your infrastructure). If you need different WAF rules per path/domain on the same ALB, add WAF on ALB too. CloudFront WAF is global (one WebACL for all edge locations). ALB WAF is regional. You can have WAF on both simultaneously.
What is the difference between WAF rate-based rules and API Gateway throttling?
WAF rate-based rules: Block by source IP when requests exceed threshold (e.g., 100 per 5 minutes). Applied at CloudFront/ALB level. API Gateway throttling: Limit by API key, stage, or method (e.g., 1000 req/sec per API key). Applied per API. Use both: WAF for DDoS/abuse protection, API Gateway for fair-use rate limiting per customer.