WAF

AWS WAF – Web Application Firewall Rules & ACLs

~ Last updated on : ~ jayendrapatil

AWS Web Application Firewall – WAF

⚠️ AWS WAF Classic End of Life: AWS WAF Classic support ended on September 30, 2025. All customers must use AWS WAF (v2). This post covers the current AWS WAF (v2) service. If you are still on WAF Classic, use the automated migration tool in the AWS WAF console.

  • AWS WAF – Web Application Firewall protects web applications from attacks by allowing rules configuration that allow, block, or monitor (count) web requests based on defined conditions.
  • helps protect from common attack techniques like SQL injection and Cross-Site Scripting (XSS). Conditions can be based on IP addresses, HTTP headers, HTTP body, URI strings, geographic location, and rate of requests.
  • tightly integrates with the following AWS services:
    • Amazon CloudFront distribution
      • AWS WAF rules run in all AWS Edge Locations, located around the world close to the end users.
      • Blocked requests are stopped before they reach the web servers.
      • Helps support custom origins outside of AWS.
    • Application Load Balancer (ALB)
      • WAF rules run in the region and can be used to protect internet-facing as well as internal load balancers.
    • Amazon API Gateway REST API
      • Can help secure and protect the REST APIs.
    • AWS AppSync GraphQL API
      • Protects GraphQL APIs from common web exploits.
    • Amazon Cognito user pool
      • Protects user authentication and registration endpoints.
    • AWS App Runner service
      • Protects containerized web applications deployed on App Runner.
      • Note: AWS App Runner is closed to new customers starting April 30, 2026.
    • AWS Verified Access instance
      • Adds web application firewall capabilities to zero-trust access.
    • AWS Amplify application
      • Protects Amplify-hosted web applications directly.
  • helps protect applications and can inspect web requests transmitted over HTTP or HTTPS.
  • provides Managed Rules which are pre-configured rules to protect applications from common threats like application vulnerabilities like OWASP, bots, or Common Vulnerabilities and Exposures (CVE).
  • logs can be sent to CloudWatch Logs log group, an S3 bucket, or Amazon Data Firehose (formerly Kinesis Data Firehose).
  • supports body inspection up to 64 KB for regional resources (API Gateway, Cognito, App Runner, Verified Access), with a default of 16 KB. CloudFront supports up to 64 KB with an 8 KB default.

WAF Benefits

  • Additional protection against web attacks using specified conditions
  • Conditions can be defined by using characteristics of web requests such as the following:
    • IP addresses that the requests originate from
    • Values in request headers
    • Strings that appear in the requests
    • Length of requests
    • Presence of SQL code that is likely to be malicious (SQL injection)
    • Presence of a script that is likely to be malicious (cross-site scripting)
    • Geographic location (country) of the request origin
    • Rate of requests from a single IP or other aggregation key
  • Managed Rules to get started quickly with pre-configured protection packs
  • Rules that can be reused for multiple web applications
  • Real-time metrics, sampled web requests, and dashboards
  • Automated administration using the WAF API
  • CloudFront Security Dashboard for unified CDN and security experience
  • Simplified console with up to 80% reduction in configuration steps (launched June 2025)

How WAF Works

WAF allows controlling the behaviour of web requests by creating conditions, rules, and web access control lists (web ACLs), now also called protection packs in the new console experience.

WAF Works

Conditions

  • Conditions define basic characteristics to watch for in a web request
    • Malicious script – XSS (Cross Site Scripting) – Attackers embed scripts that can exploit vulnerabilities in web applications
    • IP addresses or address ranges that requests originate from.
    • Size – Length of specified parts of the request, such as the query string.
    • Malicious SQL – SQL injection – Attackers try to extract data from the database by embedding malicious SQL code in a web request
    • Geographic match – Allow or block requests based on the country from which the requests originate.
    • Strings that appear in the request, for e.g., values that appear in the User-Agent header or text strings that appear in the query string.
    • Regex match – Match request components against regular expressions.
    • Label match – Match against labels added by prior rules in the web ACL evaluation.

Actions

  • Allow – allows the request to be forwarded to the protected resource.
  • Block – blocks the request. By default returns HTTP 403 (Forbidden), but can be configured with custom responses.
  • Count – counts the requests that match the rule without allowing or blocking. Useful for testing rules before enforcing them.
  • CAPTCHA – runs a CAPTCHA puzzle challenge against the request to verify a human is sending it. If solved, the request is allowed with a valid token.
  • Challenge – runs a silent browser challenge (JavaScript) to verify the client is a legitimate browser without user interaction. Useful for detecting bots without impacting user experience.

Rules

  • AWS WAF rule defines how to inspect HTTP(S) web requests and the action to take on a request when it matches the inspection criteria.
  • Each rule requires one top-level rule statement, which might contain nested statements at any depth, depending on the rule and statement type.
  • AWS WAF supports logical statements for AND, OR, and NOT that can be used to combine statements in a rule. for e.g.,
    • based on recent requests from an attacker, a rule might include the following conditions with logical AND:
      • The requests come from 192.0.2.44.
      • They contain the value BadBot in the User-Agent header.
      • They appear to include malicious SQL code in the query string.
    • All 3 conditions should be satisfied for the Rule to be passed and the associated action to be taken.
  • Rules can also add labels to matching requests. Labels are metadata that can be used by subsequent rules in the same web ACL for more complex logic.

Rate-Based Rules

  • Rate-based rules track and limit the rate of requests from individual sources.
  • Aggregation can be by IP address, forwarded IP, custom keys (headers, query parameters), or combinations.
  • Minimum rate limit is 10 requests per 5-minute window (reduced from 100 in 2025).
  • Scope-down statements can narrow which requests are counted, for e.g., only count requests to /login path.
  • Automatically blocks source IPs (or other aggregation keys) when the rate exceeds the threshold.
  • Useful for protecting against HTTP flood DDoS attacks and brute-force login attempts.

Rule Groups

  • A Rule Group is a reusable set of rules that can be added to a Web ACL.
  • Rule groups fall into the following main categories:
    • AWS Managed rule groups – maintained by AWS, includes:
      • Core rule set (CRS) – common web vulnerabilities
      • Known bad inputs – patterns associated with exploitation
      • SQL injection and XSS rules
      • IP reputation list
      • Anonymous IP list (VPNs, proxies, Tor)
      • Bot Control rule group
      • Account Takeover Prevention (ATP) rule group
      • Account Creation Fraud Prevention (ACFP) rule group
      • Anti-DDoS rule group (AWSManagedRulesAntiDDoSRuleSet) – launched June 2025
    • AWS Marketplace rule groups – third-party managed rules
    • Your own rule groups – custom rules you create and maintain
    • Service-owned rule groups – managed by AWS Firewall Manager and Shield Advanced

Web ACLs – Access Control Lists (Protection Packs)

  • A Web Access Control List (Web ACL), also called a protection pack in the new console, provides fine-grained control over all HTTP(S) web requests that the protected resource responds to.
  • Web ACLs provide:
    • Rule Groups OR Combination of Rules
    • Action – allow, block, count, CAPTCHA, or Challenge for each rule
      • WAF compares a request with the rules in a web ACL in the order listed and takes the action associated with the first rule that matches.
      • When a web request matches all conditions in a rule, WAF immediately takes the action (allow or block) and doesn’t evaluate the remaining rules.
    • Default action
      • Determines whether WAF allows or blocks a request that does not match any of the rules.
  • Supports criteria like the following to allow or block requests:
    • IP address origin of the request
    • Country of origin of the request
    • String match or regular expression (regex) match in a part of the request
    • Size of a particular part of the request
    • Detection of malicious SQL code or scripting
    • Rate-based rules
    • Label match from prior rules

AWS WAF Bot Control

  • Bot Control provides visibility and control over common and pervasive bot traffic.
  • Bot Control detection catalog covers more than 650 unique bots and agents (as of 2026), including:
    • AI search engine crawlers
    • AI data collectors and scrapers
    • AI assistants and agents
    • Large language model (LLM) training crawlers
    • Traditional scrapers, scanners, crawlers, and status monitors
  • Two levels of protection:
    • Common – identifies self-identifying bots through request headers verification
    • Targeted – advanced detection using behavioral analysis, browser fingerprinting, and ML-based detection for sophisticated bots that don’t self-identify
  • Actions available: Block, Allow, Count, CAPTCHA, Challenge, or custom response.
  • Uses AWS WAF token management for client session tracking.

AI Activity Dashboard (Feb 2026)

  • Provides centralized visibility into AI bot and agent traffic reaching applications.
  • Visualize AI traffic trends over time.
  • Identify most active bots and frequently accessed paths.
  • Analyze request volumes by bot category and verification status.
  • Take action directly: allow verified AI search crawlers while rate-limiting or blocking unverified agents.
  • Classifies AI bots into three types:
    • AI scrapers – systematically collect data to train AI models
    • AI tools – surface data from applications in AI applications using function calling
    • AI agents – autonomously navigate and interact dynamically with applications
  • Available at no additional cost for all WAF customers.

AI Traffic Monetization (June 2026)

  • Gives digital content owners and publishers a way to charge AI bots and agents for access to protected web content at the network edge.
  • Configure pricing through the AWS WAF console.
  • Define AI bot or agent policies based on verification status.
  • Supports Web Bot Auth signatures for bot identity verification.
  • Available at no additional WAF charge.

AWS WAF Fraud Control

  • Provides intelligent threat mitigation for fraud prevention.
  • Two managed rule groups:
    • Account Takeover Prevention (ATP)
      • Detects and blocks credential stuffing and brute-force login attempts.
      • Analyzes login requests for compromised credentials.
      • Uses stolen credential databases to identify credential stuffing.
    • Account Creation Fraud Prevention (ACFP)
      • Monitors sign-up and registration pages for anomalous activity.
      • Detects automated account creation using bots.
      • Blocks suspicious requests based on request identifiers and behavioral analysis.
  • Blocks fraud at the network edge when used with CloudFront, minimizing impact on application performance.
  • Uses client-side interrogation with JavaScript challenges and behavioral analysis.

AWS WAF Anti-DDoS Protection

  • The Anti-DDoS Managed Rule Group (AWSManagedRulesAntiDDoSRuleSet) launched in June 2025 provides automatic application-layer (Layer 7) DDoS protection.
  • Automatically detects and mitigates DDoS events of any duration in single-digit seconds.
  • Establishes a traffic baseline and uses it to detect anomalies.
  • When an attack is detected, labels requests:
    • event-detected – added to all incoming requests during an event
    • ddos-request – added to requests suspected of contributing to the attack
  • Supersedes the Shield Advanced Layer 7 Auto Mitigation (L7AM) feature as of March 2026.
  • Works with CloudFront, ALB, and other AWS WAF-supported services.
  • Customizable behavior using labels and additional WAF rules.
  • Managed by AWS Firewall Manager for centralized deployment.

AWS WAF Data Protection

  • Data Protection settings (Feb 2025) allow granular protection of sensitive information in WAF outputs.
  • Protects passwords, API keys, authentication tokens, and other confidential data in specific fields (headers, parameters, body content).
  • Applies to full logs, sampled requests, and Security Lake outputs.
  • Two transformation options:
    • Substitution – replaces sensitive data with static strings
    • Cryptographic hashing – replaces with hashed values for correlation without exposure
  • Configured per web ACL in the Logging and Metrics section.

AWS WAF Labels and Dynamic Label Interpolation

  • Labels are metadata added to web requests by matching rules, available for subsequent rules in the same web ACL.
  • Enable complex multi-rule logic without duplicating conditions.
  • Managed rule groups add labels to indicate match details (e.g., bot category, attack type).
  • Dynamic Label Interpolation (May 2026) enables forwarding WAF classification signals to origin servers:
    • Use ${namespace:} syntax in custom request headers, response headers, and response bodies.
    • Forward entire label namespaces at once.
    • Eliminates need for multiple rules to pass different classification signals.

New Console Experience (June 2025)

  • Simplified console reduces web application security configuration steps by up to 80%.
  • Protection Packs – pre-configured rule packs for specific workloads:
    • Recommended – enables recommended protections for selected application categories
    • Essentials – enables essential protections
    • You build it – select and customize from available options
  • Automated security recommendations based on AWS Threat Intelligence analysis of allowed traffic patterns.
  • Unified dashboard with Sankey visualization of protection activity to WAF actions.
  • Integrated log explorer with pre-built filters.
  • Direct AWS Marketplace integration for partner security solutions.
  • Available at no additional cost.

AWS WAF Architecture

AWS WAF Blacklist Example
  1. AWS WAF integration with CloudFront and Lambda to dynamically update WAF rules
  2. CloudFront receives requests on behalf of the web application, it sends access logs to an S3 bucket that contains detailed information about the requests.
  3. For every new access log stored in the S3 bucket, a Lambda function is triggered. The Lambda function parses the log files and looks for requests that resulted in error codes 400, 403, 404, and 405.
  4. Lambda function then counts the number of bad requests and temporarily stores results in the S3 bucket
  5. Lambda function updates AWS WAF rules to block the IP addresses for a period of time that you specify.
  6. After this blocking period has expired, AWS WAF allows those IP addresses to access your application again, but continues to monitor the requests from those IP addresses.
  7. Lambda function publishes execution metrics in CloudWatch, such as the number of requests analyzed and IP addresses blocked.
  8. CloudWatch metrics can be integrated with SNS for notification

Web Application Firewall Sandwich Architecture (Historical)

NOTE: This is from the older DDoS Resiliency Whitepaper. It uses third-party WAF software on EC2 instances, NOT AWS WAF. With the introduction of AWS WAF Anti-DDoS Managed Rule Group (June 2025), this pattern is largely superseded by native AWS WAF protections.

WAF Sandwich Architecture

  • DDoS attacks at the application layer commonly target web applications with lower volumes of traffic compared to infrastructure attacks.
  • WAF can be included as part of the infrastructure to mitigate these types of attacks.
  • WAFs act as filters that apply a set of rules to web traffic, which cover exploits like XSS and SQL injection but can also help build resiliency against DDoS by mitigating HTTP GET or POST floods.
  • In the “WAF sandwich,” the EC2 instance running third-party WAF software (not the AWS WAF service) is included in an Auto Scaling group and placed between two ELB load balancers.
  • With WAF sandwich pattern, the instances can scale and add additional WAF EC2 instances should the traffic spike to elevated levels.
  • Once the traffic has been inspected and filtered, the WAF EC2 instance forwards traffic to the internal, backend load balancer which then distributes traffic across the application EC2 instances.
  • Modern Alternative: Use AWS WAF with the Anti-DDoS managed rule group attached to CloudFront or ALB for native Layer 7 DDoS protection without managing EC2-based WAF instances.

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. The Web Application Development team is worried about malicious activity from 200 random IP addresses. Which action will ensure security and scalability from this type of threat?
    1. Use inbound security group rules to block the IP addresses.
    2. Use inbound network ACL rules to block the IP addresses.
    3. Use AWS WAF to block the IP addresses.
    4. Write iptables rules on the instance to block the IP addresses.
  2. You’ve been hired to enhance the overall security posture for a very large e-commerce site. They have a well architected multi-tier application running in a VPC that uses ELBs in front of both the web and the app tier with static assets served directly from S3. They are using a combination of RDS and DynamoDB for their dynamic data and then archiving nightly into S3 for further processing with EMR. They are concerned because they found questionable log entries and suspect someone is attempting to gain unauthorized access. Which approach provides a cost effective scalable mitigation to this kind of attack? [Old Exam Question]
    1. Recommend that they lease space at a DirectConnect partner location and establish a 1G DirectConnect connection to their VPC they would then establish Internet connectivity into their space, filter the traffic in hardware Web Application Firewall (WAF). And then pass the traffic through the DirectConnect connection into their application running in their VPC. (Not cost effective)
    2. Add previously identified hostile source IPs as an explicit INBOUND DENY NACL to the web tier subnet. (does not protect against new sources)
    3. Add a WAF tier by creating a new ELB and an AutoScaling group of EC2 Instances running a host-based WAF. They would redirect Route 53 to resolve to the new WAF tier ELB. The WAF tier would then pass the traffic to the current web tier. Web tier Security Groups would be updated to only allow traffic from the WAF tier Security Group
    4. Remove all but TLS 1.2 from the web tier ELB and enable Advanced Protocol Filtering. This will enable the ELB itself to perform WAF functionality. (No advanced protocol filtering in ELB)

    NOTE: This is an older exam question. In modern architectures, AWS WAF can be directly attached to CloudFront or ALB without needing EC2-based WAF instances.

  3. A company’s web application is experiencing a high volume of automated bot traffic that is consuming resources and scraping proprietary content. The security team needs to implement bot management that can differentiate between legitimate users, verified search engine crawlers, and malicious bots. Which AWS WAF feature should they implement?
    1. Rate-based rules with IP-based aggregation
    2. AWS WAF Bot Control with Targeted protection level
    3. Geographic match rules to block countries with high bot traffic
    4. Custom regex rules to match bot User-Agent strings
  4. A media company wants to allow verified AI search crawlers to access their content while blocking unverified AI data scrapers. Which combination of AWS WAF features provides this capability? (Select TWO)
    1. AWS WAF Bot Control with AI bot category detection
    2. Network ACL rules with IP deny lists
    3. AI Activity Dashboard to identify and categorize AI bot traffic
    4. AWS Shield Advanced automatic DDoS protection
    5. AWS Firewall Manager centralized policy
  5. An organization is experiencing a Layer 7 DDoS attack against their web application hosted behind an Application Load Balancer. They need automatic detection and mitigation without manual intervention. Which is the MOST effective solution?
    1. Create a rate-based rule with a threshold of 100 requests per 5 minutes
    2. Enable AWS Shield Advanced with automatic application layer mitigation
    3. Add the AWS WAF Anti-DDoS Managed Rule Group (AWSManagedRulesAntiDDoSRuleSet) to the web ACL
    4. Deploy EC2 instances running third-party WAF software in a WAF sandwich architecture
  6. A security engineer needs to protect login pages from credential stuffing attacks and detect compromised credentials. Which AWS WAF feature should they enable?
    1. AWS WAF Bot Control Common level
    2. Rate-based rules with URI path scope-down
    3. AWS WAF Fraud Control Account Takeover Prevention (ATP)
    4. SQL injection rule group from AWS Managed Rules
  7. A company needs to ensure sensitive data like API keys and passwords in web requests are not exposed in WAF logs while still maintaining full logging for security analysis. Which AWS WAF feature addresses this requirement?
    1. CloudWatch Logs field-level encryption
    2. S3 bucket encryption for WAF log storage
    3. AWS WAF Data Protection with substitution or cryptographic hashing
    4. Kinesis Data Firehose data transformation

References

AWS Security Services Cheat Sheet

AWS Identity and Security Services
~ Last updated on : ~ jayendrapatil

AWS Security Services Cheat Sheet

AWS Identity and Security Services

AWS IAM Identity Center (Successor to AWS SSO)

  • is a centralized workforce identity management service that provides single sign-on (SSO) access to multiple AWS accounts and business applications.
  • was renamed from AWS Single Sign-On (AWS SSO) in July 2022.
  • enables administrators to define, customize, and assign fine-grained access across AWS accounts and applications.
  • provides workforce users a portal to access AWS accounts and cloud applications assigned to them.
  • supports integration with external identity providers (IdPs) like Microsoft Active Directory, Okta, and Azure AD.
  • simplifies multi-account access management through AWS Organizations integration.
  • provides temporary credentials instead of long-term IAM user credentials.
  • supports attribute-based access control (ABAC) for fine-grained permissions.

Key Management Service – KMS

  • is a managed encryption service that allows the creation and control of encryption keys to enable data encryption.
  • provides a highly available key storage, management, and auditing solution to encrypt the data across AWS services & within applications.
  • uses hardware security modules (HSMs) that are FIPS 140-3 Security Level 3 certified (upgraded from FIPS 140-2 in May 2023).
  • seamlessly integrates with several AWS services to make encrypting data in those services easy.
  • supports multi-region keys, which are AWS KMS keys in different AWS Regions. Multi-Region keys are not global and each multi-region key needs to be replicated and managed independently.
  • supports External Key Store (XKS) capability (November 2022) allowing customers to store and control encryption keys on-premises or outside AWS cloud while using AWS KMS.
  • provides three key store options: Default KMS key store, CloudHSM custom key store, and External key store (XKS).
  • supports on-demand key rotation (April 2024) allowing immediate rotation of symmetric encryption keys without waiting for automatic rotation schedules, with a maximum of 10 on-demand rotations per key.
  • offers flexible automatic rotation periods (90 days to 2560 days) instead of the previous fixed annual rotation.
  • supports post-quantum cryptography:
    • ML-KEM hybrid post-quantum key exchange for TLS connections to KMS endpoints, protecting against “harvest now, decrypt later” attacks.
    • ML-DSA (FIPS 204) post-quantum digital signatures (June 2025) for quantum-resistant signing operations within FIPS 140-3 Level 3 certified HSMs.

CloudHSM

  • provides secure cryptographic key storage to customers by making hardware security modules (HSMs) available in the AWS cloud
  • helps manage your own encryption keys using FIPS 140-3 Level 3 validated HSMs (upgraded from FIPS 140-2).
  • single tenant, dedicated physical device to securely generate, store, and manage cryptographic keys used for data encryption
  • are inside the VPC (not EC2-classic) & isolated from the rest of the network
  • can use VPC peering to connect to CloudHSM from multiple VPCs
  • integrated with Amazon Redshift and Amazon RDS for Oracle
  • EBS volume encryption, S3 object encryption and key management can be done with CloudHSM but requires custom application scripting
  • is NOT fault-tolerant and would need to build a cluster as if one fails all the keys are lost
  • enables quick scaling by adding and removing HSM capacity on-demand, with no up-front costs.
  • automatically load balance requests and securely duplicates keys stored in any HSM to all of the other HSMs in the cluster.
  • launched hsm2m.medium instance type (August 2024) with FIPS 140-3 Level 3 certification, increased key storage (16,666 keys), higher elliptic curve performance, mTLS support, and non-FIPS cluster mode option.
  • deprecated hsm1.medium instance type — no new hsm1 clusters can be created as of April 2025; customers must migrate to hsm2m.medium.
  • expensive, prefer AWS Key Management Service (KMS) if cost is a criteria.

AWS Payment Cryptography

  • is a managed service for payment processing cryptographic operations (launched June 2023).
  • provides payment-specific HSMs that replace on-premises payment hardware security modules.
  • helps meet PCI (Payment Card Industry) security requirements and compliance needs.
  • supports cryptographic operations like PIN generation, validation, and credit/debit card security code processing.
  • manages underlying physical HSM infrastructure and key management automatically.
  • integrates with AWS IAM for authorization and AWS CloudTrail for auditing.
  • enables payment processing workloads to move to the cloud securely.
  • provides elastic scaling for payment cryptography operations.

AWS Private Certificate Authority (Private CA)

  • is a managed private certificate authority service for issuing and managing private SSL/TLS certificates.
  • removes upfront investment and ongoing maintenance costs of operating your own private CA.
  • supports two operating modes: General-purpose mode (certificates with any validity period) and Short-lived certificate mode (certificates valid up to 7 days, launched February 2023).
  • integrates with AWS Certificate Manager (ACM) for automated certificate provisioning and renewal.
  • supports Private CA Connector for Active Directory (September 2023) enabling AWS Private CA as drop-in replacement for self-managed enterprise CAs without local agents.
  • supports post-quantum ML-DSA digital certificates (November 2025) for transitioning PKI toward post-quantum cryptography.
  • provides audit and compliance support through AWS CloudTrail integration.
  • enables certificate-based authentication for services like Amazon WorkSpaces.

AWS WAF

  • is a web application firewall that helps monitor the HTTP/HTTPS traffic and allows controlling access to the content.
  • helps protect web applications from attacks by allowing rules configuration that allow, block, or monitor (count) web requests based on defined conditions. These conditions include IP addresses, HTTP headers, HTTP body, URI strings, SQL injection and cross-site scripting.
  • helps define Web ACLs, which is a combination of Rules that is a combinations of Conditions and Action to block or allow
  • integrated with CloudFront, Application Load Balancer (ALB), API Gateway, Amazon Cognito, AWS App Runner, and AWS Verified Access.
  • supports custom origins outside of AWS, when integrated with CloudFront
  • provides AWS WAF Fraud Control with three capabilities:
    • Account Takeover Prevention (ATP) – Protects login pages against credential stuffing attacks
    • Account Creation Fraud Prevention (ACFP) – Detects and blocks automated bot-based account creation
    • Bot Control – Detects and controls common bots and targeted bots with a catalog of 650+ unique bots including AI crawlers, AI data collectors, AI assistants, and LLM training crawlers
  • supports Challenge and CAPTCHA actions for bot mitigation.
  • provides AI Activity Dashboard (February 2026) for visibility into AI bot and agent traffic patterns.
  • launched AI Traffic Monetization (June 2026), a Bot Control capability that lets content providers price, meter, and collect payment from AI bots and agents accessing their content and APIs via HTTP 402 Payment Required responses.
  • AWS WAF Classic reached end of support on September 30, 2025. All customers must use AWS WAF (v2).

AWS Verified Access

  • provides VPN-less, secure access to corporate applications (GA April 2023).
  • implements Zero Trust security model for application access without traditional VPN.
  • validates each application request against identity and device security requirements before granting access.
  • integrates with identity providers (IdPs) and device management systems for authentication and authorization.
  • uses Cedar policy language for fine-grained access control policies.
  • supports AWS WAF integration for additional web application protection.
  • provides signed identity context to end applications for additional security.
  • simplifies remote access management and improves user experience compared to VPN.
  • eliminates VPN infrastructure management overhead.

Amazon Verified Permissions

  • is a fully managed fine-grained authorization service for custom applications (GA June 2023).
  • uses Cedar, an open-source policy language released May 2023, for defining authorization policies.
  • enables developers to externalize authorization logic from application code.
  • provides centralized policy management and administration.
  • offers millisecond-latency authorization decisions with provably correct results.
  • supports policy validation using automated reasoning to prevent misconfigurations.
  • integrates with identity providers for user and group information.
  • enables fine-grained permissions based on user attributes, resource attributes, and context.
  • provides policy versioning and audit capabilities.
  • follows “explicit permit” and “forbid overrides permit” principles.

AWS Secrets Manager

  • helps protect secrets needed to access applications, services, and IT resources.
  • enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
  • secure secrets by encrypting them with encryption keys managed using AWS KMS.
  • offers native secret rotation with built-in integration for RDS, Redshift, and DocumentDB.
  • supports Lambda functions to extend secret rotation to other types of secrets, including API keys and OAuth tokens.
  • supports IAM and resource-based policies for fine-grained access control to secrets and centralized secret rotation audit for resources in the AWS Cloud, third-party services, and on-premises.
  • enables secret replication in multiple AWS regions to support multi-region applications and disaster recovery scenarios, automatically keeping replicas in sync including rotation.
  • launched Managed External Secrets (November 2025) — a new secret type enabling automatic rotation for third-party SaaS credentials (Salesforce, MongoDB Atlas, Confluent Cloud, Datadog, Snowflake) without custom Lambda rotation functions.
  • supports hybrid post-quantum TLS (ML-KEM) for protecting secrets against future quantum computing threats (April 2026).
  • supports private access using VPC Interface endpoints

AWS Shield

  • is a managed service that provides protection against Distributed Denial of Service (DDoS) attacks for applications running on AWS
  • provides protection for all AWS customers against common and most frequently occurring infrastructure (layer 3 and 4) attacks like SYN/UDP floods, reflection attacks, and others to support high availability of applications on AWS.
  • provides AWS Shield Advanced with additional protections against more sophisticated and larger attacks for applications running on EC2, ELB, CloudFront, AWS Global Accelerator, and Route 53.
  • Shield Advanced provides 24/7 access to AWS Shield Response Team (SRT) and cost protection against DDoS-related spikes.
  • AWS Shield Network Security Director (preview) performs analysis of resources to visualize network topology, identify configuration issues, and provide actionable remediation recommendations.

AWS GuardDuty

  • offers threat detection that enables continuous monitoring and protects the AWS accounts and workloads.
  • is a Regional service
  • analyzes continuous streams of meta-data generated from AWS accounts and network activity found in AWS CloudTrail Events, EKS audit logs, VPC Flow Logs, and DNS Logs.
  • integrated threat intelligence
  • combines machine learning, anomaly detection, network monitoring, and malicious file discovery, utilizing both AWS-developed and industry-leading third-party sources to help protect workloads and data on AWS
  • supports suppression rules, trusted IP lists, and threat lists. Now supports custom entity lists (September 2025) with domain-based threat intelligence in addition to IP-based lists.
  • provides Malware Protection to detect malicious files on EBS volumes and S3 objects (on-demand scanning API).
  • provides EKS Runtime Monitoring using fully managed EKS add-on for visibility into container runtime activities (file access, process execution, network connections).
  • provides RDS Protection for profiling and monitoring access activity to Amazon Aurora databases.
  • provides Lambda Protection for monitoring AWS Lambda function invocations and runtime behavior.
  • can identify specific containers within EKS clusters that are potentially compromised and detect privilege escalation attempts.
  • launched Extended Threat Detection (December 2024) — AI/ML-powered attack sequence identification that detects multi-stage attacks spanning multiple AWS data sources and resources, including EC2 instances and ECS clusters on Fargate.
  • offers flexible protection plan configuration — new accounts can inherit protection plans automatically, and plans can be enabled/disabled independently.
  • operates completely independently from the resources so there is no risk of performance or availability impacts on the workloads.

Amazon Inspector

  • is a vulnerability management service that continuously scans the AWS workloads for vulnerabilities
  • automatically discovers and scans EC2 instances and container images residing in Elastic Container Registry (ECR) for software vulnerabilities and unintended network exposure.
  • supports AWS Lambda function scanning for vulnerabilities in application code and dependencies.
  • provides CI/CD integration with open-source plugins for Jenkins, TeamCity, and other CI/CD tools to scan container images at build time.
  • provides code security capabilities including static application security testing (SAST), software composition analysis (SCA), and infrastructure as code (IaC) scanning via SCM tool connections.
  • supports agentless EC2 scanning (March 2026) with expanded detection coverage including Windows OS vulnerability scanning without requiring an agent.
  • launched Inspector VM Scanner (May 2026) for improved agent-based scanning with more granular package collection and reduced CPU utilization on EC2 instances.
  • creates a finding, when a software vulnerability or network issue is discovered, that describes the vulnerability, rates its severity, identifies the affected resource, and provides remediation guidance.
  • is a Regional service.
  • Amazon Inspector Classic reached end of support on May 20, 2026. All customers must use Amazon Inspector (v2).

Amazon Security Lake

  • is a fully managed security data lake service (GA November 2023).
  • automatically centralizes security data from AWS environments, SaaS providers, on-premises, and cloud sources into a purpose-built data lake.
  • normalizes security data into the Open Cybersecurity Schema Framework (OCSF) standard format.
  • aggregates data from AWS services like CloudTrail, VPC Flow Logs, Route 53 logs, and third-party sources.
  • enables comprehensive security data analysis across entire organization.
  • automatically collects data for existing and new accounts with multi-account support.
  • stores security data in customer’s own AWS account for data ownership and control.
  • integrates with analytics tools like Amazon Athena, Amazon OpenSearch, and third-party SIEM solutions.
  • supports cross-region data aggregation for centralized security monitoring.
  • pricing based on data ingestion volume and normalization (no charge for third-party or custom data).

Amazon Detective

  • helps analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities.
  • automatically collects log data from the AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data to easily conduct faster and more efficient security investigations.
  • enables customers to view summaries and analytical data associated with CloudTrail logs, EKS audit logs, VPC Flow Logs.
  • provides finding groups that let you examine multiple activities related to a potential security event, analyze root cause for high severity GuardDuty findings, and visualize entity connections.
  • provides detailed summaries, analysis, and visualizations of the behaviors and interactions amongst your AWS accounts, EC2 instances, AWS users, roles, and IP addresses.
  • supports automated investigation of IAM users and roles for indicators of compromise (IoC).
  • maintains up to a year of aggregated data
  • is a Regional service and needs to be enabled on a region-by-region basis.
  • is a multi-account service that aggregates data from monitored member accounts under a single administrative account within the same region.
  • integrates with Amazon Security Lake for lateral movement investigations.
  • has no impact on the performance or availability of the AWS infrastructure since it retrieves the log data and findings directly from the AWS services.

AWS Security Hub

  • is a unified cloud security solution that prioritizes critical security issues and helps respond at scale to protect cloud environments.
  • was completely re-imagined at re:Invent 2025 — now unifies AWS security services including Amazon GuardDuty, Amazon Inspector, and Amazon Macie into a single experience.
  • provides near real-time risk analytics (GA December 2025) with automated correlation, enrichment, and prioritization of security signals from multiple sources.
  • collects security data from across AWS accounts, services, and supported third-party partner products.
  • is Regional but supports cross-region aggregation of findings.
  • automatically runs continuous, account-level configuration and security checks based on AWS best practices and industry standards including CIS Foundations, PCI DSS, and NIST frameworks.
  • detects unused IAM permissions, roles, and credentials (May 2026) across the AWS organization for identity risk reduction.
  • offers Security Hub Extended plan (2026) providing full-stack enterprise security with 21+ curated partner solutions across 9 security categories (endpoint, identity, email, network, data, browser, cloud, AI, security operations).
  • supports integration with Amazon EventBridge for custom actions and automated remediation.
  • has multi-account management through AWS Organizations integration, which allows delegating an administrator account for the organization.
  • works with AWS Config to perform most of its security checks for controls.

AWS Macie

  • Macie is a data security service that discovers sensitive data by using machine learning and pattern matching, provides visibility into data security risks, and enables automated protection against those risks.
  • provides an inventory of the S3 buckets and automatically evaluates and monitors the buckets for security and access control.
  • automates the discovery, classification, and reporting of sensitive data.
  • supports automated sensitive data discovery that continuously samples and analyzes S3 objects, builds an interactive data map, and provides a sensitivity score for each bucket.
  • generates a finding for you to review and remediate as necessary if it detects a potential issue with the security or privacy of the data, such as a bucket that becomes publicly accessible.
  • can analyze objects encrypted with dual-layer server-side encryption (DSSE-KMS).
  • provides multi-account support using AWS Organizations to enable Macie across all of the accounts.
  • is a regional service and must be enabled on a region-by-region basis and helps view findings across all the accounts within each Region.
  • supports VPC Interface Endpoints to access Macie privately from a VPC without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.

AWS Artifact

  • is a self-service audit artifact retrieval portal that provides customers with on-demand access to AWS’ compliance documentation and agreements.
  • can use AWS Artifact Reports to download AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports.
  • supports listCustomerAgreements API (November 2024) for programmatic tracking of active agreements across accounts.
  • provides SOC reports in machine-readable OSCAL format in addition to PDF.

AWS Security Services – Practice Questions

  1. A company needs to manage encryption keys with FIPS 140-3 Level 3 compliance and wants AWS to handle the infrastructure. Which service should they use?
    • A. AWS CloudHSM
    • B. AWS KMS ✓
    • C. AWS Secrets Manager
    • D. AWS Certificate Manager
  2. A financial institution needs to process payment card transactions in the cloud while meeting PCI compliance requirements. Which service should they use?
    • A. AWS CloudHSM
    • B. AWS KMS
    • C. AWS Payment Cryptography ✓
    • D. AWS Private CA
  3. A company wants to provide secure access to corporate applications without using VPN. Which service implements Zero Trust access?
    • A. AWS Client VPN
    • B. AWS Verified Access ✓
    • C. AWS Direct Connect
    • D. AWS PrivateLink
  4. A development team needs to externalize authorization logic from their application and use fine-grained permissions. Which service should they use?
    • A. AWS IAM
    • B. Amazon Cognito
    • C. Amazon Verified Permissions ✓
    • D. AWS IAM Identity Center
  5. A company needs to centralize security data from multiple AWS accounts and third-party sources for analysis. Which service should they use?
    • A. AWS Security Hub
    • B. Amazon Security Lake ✓
    • C. Amazon Detective
    • D. AWS CloudTrail
  6. Which AWS service uses AI/ML to detect multi-stage attack sequences spanning multiple data sources and resources?
    • A. Amazon Inspector
    • B. AWS Security Hub
    • C. Amazon GuardDuty Extended Threat Detection ✓
    • D. Amazon Detective
  7. A company wants to scan EC2 instances for vulnerabilities without installing any agent. Which capability supports this?
    • A. AWS Config Rules
    • B. Amazon Inspector agentless scanning ✓
    • C. AWS Security Hub
    • D. Amazon GuardDuty
  8. Which AWS WAF capability allows content providers to charge AI bots for accessing their content?
    • A. AWS WAF Fraud Control
    • B. AWS WAF Bot Control
    • C. AWS WAF AI Traffic Monetization ✓
    • D. AWS Shield Advanced
  9. A company needs to automatically rotate third-party SaaS credentials without writing custom Lambda functions. Which feature supports this?
    • A. AWS Secrets Manager Managed External Secrets ✓
    • B. AWS Systems Manager Parameter Store
    • C. AWS KMS automatic rotation
    • D. AWS Config
  10. A security team wants a unified view that correlates findings from GuardDuty, Inspector, and Macie with near real-time risk analytics. Which service provides this?
    • A. Amazon Detective
    • B. Amazon Security Lake
    • C. AWS Security Hub ✓
    • D. AWS CloudTrail Lake
  11. An organization needs to protect their KMS encryption keys against future quantum computing threats. Which KMS feature should they use?
    • A. External Key Store (XKS)
    • B. Multi-Region keys
    • C. ML-KEM hybrid post-quantum TLS ✓
    • D. On-demand key rotation
  12. Which service was renamed from AWS Single Sign-On (SSO) in July 2022?
    • A. AWS IAM
    • B. Amazon Cognito
    • C. AWS IAM Identity Center ✓
    • D. AWS Directory Service

References

Network Firewall vs WAF vs Security Groups vs NACLs

Image ~ ~ Last updated on : ~ jayendrapatil

AWS Network Firewall vs WAF vs Security Groups vs NACLs

📅 Updated June 2026: Added AWS WAF Classic EOL notice, Network Firewall Transit Gateway attachment, Web Category-based filtering, WAF AI Bot Control dashboard, Security Group VPC Associations, and AWS Shield Network Security Director.

⚠️ AWS WAF Classic Deprecated

AWS WAF Classic reached End of Life (EOL) on September 30, 2025.

All references to WAF in this post refer to the current AWS WAF (formerly “AWS WAFv2”). If you are still using WAF Classic, you must migrate immediately.

Migration: Use the AWS WAF Classic migration guide and the CreateWebACLMigrationStack API to migrate your web ACLs.

Overview

  • AWS Network Firewall is a stateful, fully managed network firewall and intrusion detection and prevention service (IDS/IPS) for VPCs.
  • AWS WAF is a web application firewall that helps protect web applications from attacks by allowing rules configuration that allow, block, or monitor (count) web requests based on defined conditions.
  • Security groups act as a virtual firewall for associated instances, controlling both inbound and outbound traffic at the instance level.
  • Network access control lists (NACLs) act as a firewall for associated subnets, controlling both inbound and outbound traffic at the subnet level.

AWS Security Groups vs NACLs vs WAF vs Network Firewall

Comparison Table

Feature Security Groups NACLs AWS WAF AWS Network Firewall
Scope Instance/ENI level Subnet level Application level (Layer 7) VPC level (Layers 3-7)
State Stateful Stateless Stateful Stateful & Stateless
Rules Allow rules only Allow and Deny rules Allow, Block, Count, CAPTCHA, Challenge Allow, Drop, Reject, Alert
Rule Processing All rules evaluated Rules processed in order (lowest number first) Rules processed by priority Rules processed by priority with strict/action order
Traffic Inspection IP, Port, Protocol IP, Port, Protocol HTTP/HTTPS headers, body, URI, query strings IP, Port, Protocol, Domain, HTTP/TLS, IDS/IPS signatures
IDS/IPS No No No (application-level only) Yes (Suricata-compatible)
TLS Inspection No No No (inspects after decryption at ALB/CloudFront) Yes (decrypts and re-encrypts HTTPS traffic)
Domain Filtering No No No Yes (FQDN, SNI, URL categories)
Bot Control No No Yes (650+ bots including AI crawlers) No (use WAF for bot control)
Cost Free Free Pay per web ACL, rule, and requests Pay per endpoint hour and data processed

Security Groups

  • Act as a virtual firewall at the instance/ENI level
  • Stateful – return traffic is automatically allowed regardless of rules
  • Support allow rules only – cannot create deny rules
  • All rules are evaluated before deciding whether to allow traffic
  • Can reference other security groups as sources/destinations (including cross-account)
  • Applied to ENIs – an instance can have multiple security groups
  • Default security group allows all outbound and denies all inbound (except from same group)

Security Group Updates (2024-2026)

  • Security Group VPC Associations (Oct 2024) – Associate a security group with multiple VPCs in the same account and Region, eliminating the need to duplicate security groups across VPCs
  • Shared Security Groups – In shared VPCs, security groups can now be shared with participant accounts using AWS RAM
  • Cross-VPC Security Group Referencing (AWS Cloud WAN) – Create inbound rules referencing security groups in other VPCs attached to AWS Cloud WAN within the same Region

Network Access Control Lists (NACLs)

  • Act as a firewall at the subnet level
  • Stateless – return traffic must be explicitly allowed by rules
  • Support both allow and deny rules
  • Rules are processed in number order (lowest first); processing stops at first match
  • Default NACL allows all inbound and outbound traffic
  • Custom NACLs deny all traffic by default until rules are added
  • Applied automatically to all instances in the associated subnet
  • Provide broad subnet-level protection as a first line of defense

AWS WAF (Web Application Firewall)

  • Operates at Layer 7 (Application Layer) – inspects HTTP/HTTPS requests
  • Protects against common web exploits: SQL injection, XSS, CSRF
  • Deployed on CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, and Verified Access
  • Rules based on IP addresses, HTTP headers, HTTP body, URI strings, query strings, and geo-location
  • Supports rate-based rules for DDoS mitigation at application layer
  • Managed rule groups from AWS and AWS Marketplace partners
  • Centrally managed using AWS Firewall Manager across accounts

AWS WAF Updates (2024-2026)

  • New Console Experience (June 2025) – Pre-configured protection packs for specific workloads (e-commerce, APIs, transaction processing), automated security recommendations, and a unified dashboard
  • AI Activity Dashboard (Feb 2026) – Bot Control detection catalog covers 650+ unique bots including AI search engine crawlers, AI data collectors, AI assistants, and LLM training crawlers
  • Dynamic Label Interpolation (May 2026) – Forward WAF classification signals to origin and embed context in responses with a single rule
  • Protection Packs – Pre-configured Web ACLs tailored to specific workload types with expert-curated rules that are continuously updated

AWS Network Firewall

  • Operates at Layers 3-7 – provides network-level and application-level filtering
  • Deployed within a VPC using firewall endpoints in dedicated firewall subnets
  • Supports both stateful and stateless rule groups
  • Intrusion Detection and Prevention (IDS/IPS) using Suricata-compatible rules
  • Domain name filtering – Allow/deny based on FQDN or SNI for encrypted traffic
  • TLS Inspection – Decrypts and re-encrypts HTTPS traffic for deep packet inspection
  • Supports AWS Managed Rule Groups for active threat defense (malware, botnets, C2 channels)
  • Auto-scales based on traffic load
  • Centrally managed using AWS Firewall Manager
  • Can be shared across accounts using AWS RAM

AWS Network Firewall Updates (2024-2026)

  • Transit Gateway Native Attachment (2026) – Attach Network Firewall directly to Transit Gateway, eliminating the need for a dedicated inspection VPC. Simplifies architecture and enables flexible cost allocation across accounts.
  • Web Category-based Filtering (Jan 2026) – Pre-defined URL categories to control access to GenAI services, social media, streaming sites, and other web categories directly in firewall rules
  • Enhanced Managed Rules from Marketplace Partners (Apr 2026) – Support for up to 10 million domain name indicators and 1 million IP addresses in managed rule groups
  • Price Reductions (Feb 2026) – Hourly and data processing discounts on NAT Gateways service-chained with Network Firewall secondary endpoints
  • Enhanced Console & Monitoring (Sep 2025) – Expanded monitoring insights, advanced TLS inspection features, PrivateLink endpoint analysis, and improved filtering
  • Application Layer Traffic Controls (Sep 2025) – Enhanced default rules for handling TLS client hellos and HTTP requests split across multiple packets

When to Use Each Service

Use Case Recommended Service
Control traffic to/from specific instances Security Groups
Block specific IPs at the subnet level NACLs
Protect web apps from SQL injection, XSS AWS WAF
Block/manage bot traffic and AI crawlers AWS WAF (Bot Control)
Rate limiting at application layer AWS WAF
IDS/IPS for VPC traffic AWS Network Firewall
Domain/FQDN-based egress filtering AWS Network Firewall
TLS traffic inspection (decrypt/re-encrypt) AWS Network Firewall
Block access to GenAI/social media categories AWS Network Firewall (Web Category Filtering)
Centralized inspection across multiple VPCs AWS Network Firewall + Transit Gateway
Centralized policy management across accounts AWS Firewall Manager
Identify misconfigured network security AWS Shield Network Security Director

AWS Shield Network Security Director (Preview)

  • Launched June 2025 as a capability of AWS Shield
  • Discovers compute, networking, and network security resources across your AWS accounts
  • Identifies missing or misconfigured network security services (WAF, Security Groups, NACLs)
  • Provides actionable remediation recommendations based on AWS best practices and threat intelligence
  • Supports multi-account analysis with AWS Organizations integration (Dec 2025)
  • Findings available in AWS Security Hub (Mar 2026)
  • Visualizes network topology and security configuration issues

AWS Firewall Manager

  • Centrally configure and manage firewall rules across multiple accounts and resources in an AWS Organization
  • Manages policies for AWS WAF, AWS Network Firewall, Security Groups, NACLs, and Shield Advanced
  • Automatically applies protections to new accounts and resources as they are added
  • Supports retrofitting – application teams can customize rules in Firewall Manager-managed Web ACLs using console or IaC tools
  • Requires AWS Organizations and a designated Firewall Manager administrator account

Defense in Depth Architecture

AWS recommends a layered security approach combining all four services:

  1. NACLs – First line of defense at subnet boundary; block known malicious IPs
  2. Security Groups – Instance-level access control; allow only required ports/protocols
  3. AWS Network Firewall – VPC-level IDS/IPS, domain filtering, and deep packet inspection
  4. AWS WAF – Application-level protection against web exploits and bot traffic

Use AWS Firewall Manager for centralized policy management and AWS Shield Network Security Director to identify gaps in your security posture.

AWS Certification Exam Practice Questions

Question 1:

A company needs to inspect all egress traffic from their VPC and block access to known malicious domains. They also need IDS/IPS capabilities. Which service should they use?

  1. AWS WAF
  2. Network ACLs
  3. AWS Network Firewall
  4. Security Groups

Answer: C – AWS Network Firewall provides domain-based filtering, IDS/IPS with Suricata-compatible rules, and can inspect all VPC egress traffic. WAF only inspects HTTP/HTTPS at the application layer and requires a load balancer or CloudFront.

Question 2:

A solutions architect needs to protect a web application from SQL injection and cross-site scripting attacks. The application is behind an Application Load Balancer. Which is the MOST appropriate service?

  1. AWS Network Firewall
  2. AWS WAF
  3. Network ACLs
  4. Security Groups

Answer: B – AWS WAF is specifically designed to protect web applications from common exploits like SQL injection and XSS. It integrates directly with ALB to inspect HTTP/HTTPS requests.

Question 3:

A company wants to block a specific IP address from accessing any resources in a subnet. Which service provides the ability to explicitly DENY traffic?

  1. Security Groups
  2. AWS WAF
  3. Network ACLs
  4. AWS Network Firewall

Answer: C – NACLs support both allow and deny rules at the subnet level. Security Groups only support allow rules. While WAF and Network Firewall can also block traffic, NACLs are the most appropriate for simple IP-based subnet-level blocking.

Question 4:

An organization needs to control access to generative AI services from their corporate VPC. They want to block employees from accessing specific AI platforms while allowing approved ones. Which feature should they use?

  1. AWS WAF Bot Control
  2. Security Group rules
  3. AWS Network Firewall with Web Category-based filtering
  4. NACLs with deny rules

Answer: C – AWS Network Firewall’s Web Category-based filtering (launched Jan 2026) enables controlling access to GenAI services using pre-defined URL categories without maintaining individual domain lists.

Question 5:

A company wants to detect and manage AI crawlers and LLM training bots accessing their web application. Which AWS service provides this capability?

  1. AWS Network Firewall
  2. AWS WAF with Bot Control
  3. Security Groups
  4. AWS Shield Advanced

Answer: B – AWS WAF Bot Control’s detection catalog covers 650+ unique bots including AI search engine crawlers, AI data collectors, AI assistants, and LLM training crawlers. The AI Activity Dashboard provides visibility into AI bot traffic patterns.

Question 6:

A company operates multiple VPCs connected via Transit Gateway and wants to centrally inspect all inter-VPC traffic. What is the SIMPLEST architecture using AWS Network Firewall?

  1. Deploy Network Firewall in each VPC
  2. Create a dedicated inspection VPC with firewall endpoints
  3. Attach Network Firewall directly to Transit Gateway
  4. Use Gateway Load Balancer with third-party appliances

Answer: C – AWS Network Firewall now supports native Transit Gateway attachment, eliminating the need for a dedicated inspection VPC. This simplifies architecture by directly attaching the firewall to the Transit Gateway.

Question 7:

Which statement correctly describes the difference between Security Groups and NACLs? (Select TWO)

  1. Security Groups are stateless; NACLs are stateful
  2. Security Groups operate at instance level; NACLs operate at subnet level
  3. Security Groups evaluate all rules; NACLs process rules in order
  4. NACLs support allow rules only; Security Groups support allow and deny
  5. Both Security Groups and NACLs can reference other security groups

Answer: B, C – Security Groups operate at the instance/ENI level and evaluate all rules before making a decision. NACLs operate at the subnet level and process rules in numerical order, stopping at the first match. Security Groups are stateful (not stateless), and NACLs support both allow and deny rules.

Question 8:

A security team needs to identify which AWS resources have misconfigured network security services across their multi-account environment. Which service should they use?

  1. AWS Config
  2. AWS Shield Network Security Director
  3. Amazon Inspector
  4. AWS Firewall Manager

Answer: B – AWS Shield Network Security Director discovers resources across accounts, identifies missing or misconfigured network security services (WAF, Security Groups, NACLs), and provides remediation recommendations. It integrates with AWS Organizations for multi-account analysis.

References

AWS Identity & Security Services Cheat Sheet

~ Last updated on : ~ jayendrapatil ~ 9 Comments

AWS Identity & Security Services Cheat Sheet

AWS Identity and Security Services

📌 Last Updated: June 2026 — Includes AWS Security Hub reimagined (re:Invent 2025), AWS Security Agent (GA March 2026), mandatory MFA enforcement for all root users, GuardDuty Extended Threat Detection, and IAM Identity Center multi-Region replication.

AWS Identity Services Cheat Sheet

AWS Security Services Cheat Sheet

AWS Identity & Security Services Overview

AWS Security, Identity, and Compliance services provide a comprehensive set of tools to help protect data, accounts, and workloads. These services are organized into the following categories:

Identity and Access Management

  • AWS Identity and Access Management (IAM) – Securely manage access to AWS services and resources using users, groups, roles, and policies
  • AWS IAM Identity Center (formerly AWS SSO) – Centrally manage SSO access to multiple AWS accounts and business applications
    • Now supports multi-Region replication (Feb 2026) for high availability
    • Supports IPv6 dual-stack endpoints
  • Amazon Cognito – Customer identity and access management (CIAM) for web and mobile apps
    • Now supports passwordless authentication with passkeys (FIDO2/WebAuthn), email OTP, and SMS OTP (Nov 2024)
    • New feature tiers: Essentials and Plus (Nov 2024)
    • Managed Login for pre-built authentication UIs
  • Amazon Verified Permissions – Scalable, fine-grained authorization using Cedar policy language for custom applications
  • AWS Resource Access Manager (RAM) – Securely share AWS resources across accounts and within AWS Organizations
  • AWS Directory Service – Managed Microsoft Active Directory in the AWS Cloud

Detection and Response

  • Amazon GuardDuty – Intelligent threat detection that continuously monitors for malicious activity
    • Extended Threat Detection (re:Invent 2024) – AI/ML-powered attack sequence identification across multiple data sources
    • Now covers EC2, ECS, EKS, S3, and IAM attack sequences
    • Custom entity lists for domain-based threat intelligence (Sept 2025)
  • Amazon Detective – Analyze, investigate, and identify root cause of security findings using ML and graph theory
  • Amazon Inspector – Automated vulnerability management for EC2 instances and container images in ECR
  • AWS Security Hub – Cloud security posture management (CSPM) and unified security operations
    • Reimagined at re:Invent 2025 – Unifies GuardDuty, Inspector, and other services into a single experience
    • Near real-time analytics and risk prioritization (GA Dec 2025)
    • Extended Plan (GA Feb 2026) – Full-stack enterprise security with 21 curated partner solutions across 9 categories
    • Expanding to multicloud environments
  • AWS Security Agent (GA March 2026) – AI-powered frontier agent for proactive application security
    • Automated security reviews tailored to organizational requirements
    • On-demand context-aware penetration testing
    • Full repository code scanning (Preview May 2026)
    • Operates like a human penetration tester – identifies, exploits, and validates vulnerabilities

Data Protection

Network and Application Protection

  • AWS WAF – Web application firewall to protect against common web exploits and bots
  • AWS Shield – Managed DDoS protection (Standard and Advanced tiers)
  • AWS Network Firewall – Managed network firewall for VPC with stateful inspection and IPS
  • AWS Firewall Manager – Centrally configure and manage firewall rules across accounts in AWS Organizations

Security Data Management and Compliance

  • Amazon Security Lake – Centralize security data from AWS, SaaS, on-premises using OCSF standard
    • Achieved FedRAMP High and Moderate authorization (April 2025)
  • AWS Audit Manager – Continuously audit AWS usage for risk and compliance assessment
  • AWS Artifact – On-demand access to AWS security and compliance reports

Key Updates (2024-2026)

  • MFA Enforcement (2024-2025) – AWS now mandates MFA for all root users across all account types. Prevents over 99% of password-related attacks.
  • AWS Security Hub Reimagined (re:Invent 2025) – Completely redesigned to unify security services into a single experience with near real-time analytics and AI-driven risk prioritization.
  • AWS Security Agent (GA March 2026) – First AI-powered frontier agent for autonomous application security testing and code scanning.
  • GuardDuty Extended Threat Detection (re:Invent 2024) – AI/ML attack sequence identification now covers EC2, ECS, EKS workloads.
  • IAM Identity Center Multi-Region (Feb 2026) – Replicate identity center configuration across multiple AWS Regions for high availability.
  • Amazon Cognito Passwordless (Nov 2024) – Native passkey support with FIDO2/WebAuthn, email OTP, and SMS OTP authentication.
  • Centralized Root Access Management (Nov 2024) – Centrally manage root credentials and perform privileged tasks across AWS Organizations member accounts.
  • Agentic AI Security Framework (2025) – New Agentic AI Security Scoping Matrix for securing autonomous AI systems.

AWS Certification Relevance

  • Solutions Architect (Associate/Professional) – IAM, VPC security, encryption, Security Hub, GuardDuty
  • Security Specialty – All services in depth, including Security Lake, Detective, Macie, Inspector
  • SysOps Administrator – Security Hub, Config, GuardDuty, IAM best practices
  • Developer Associate – Cognito, IAM roles, KMS, Secrets Manager
  • DevOps Professional – Security automation, Inspector, Security Hub integrations