WAF, Shield and Network Firewall: SOA-C03 study notes and practice questions
What to know about WAF, Shield and Network Firewall for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.
Protection questions name an attack or unwanted traffic and ask for the right control.
AWS WAF
Attaches a web ACL to CloudFront, Application Load Balancers, API Gateway REST APIs, AppSync, Cognito user pools, App Runner and Verified Access. Not to Network Load Balancers or EC2 directly.
Managed rule groups (core rule set, SQL injection, known bad inputs, IP reputation, Bot Control, account takeover prevention).
Rate-based rules block a client IP (or other key) that exceeds a request rate.
IP set, geo match, regex and size constraint rules.
Count mode tests rules without blocking.
Logs to CloudWatch Logs, S3 or Data Firehose; sampled requests show matches in the console.
AWS Shield
Standard: automatic layer 3/4 DDoS protection for everyone, no charge.
Advanced: paid; enhanced protection for CloudFront, Route 53, Global Accelerator, ELB and Elastic IPs; Shield Response Team; cost protection; automatic application-layer mitigation with WAF.
AWS Network Firewall
A managed, stateful firewall for VPC traffic: domain allow/deny lists (for example, only let instances reach approved update sites), intrusion prevention (Suricata rules), and stateless filtering. Deployed in its own subnets with routing through it.
AWS Firewall Manager
Central policies across an organization for WAF, Shield Advanced, security groups, Network Firewall and Route 53 Resolver DNS Firewall, applied to new accounts and resources automatically.
Other controls
Security groups and network ACLs for basic port and IP filtering.
Route 53 Resolver DNS Firewall blocks DNS lookups of malicious domains.
CloudFront geographic restrictions for country blocks at the edge.
Common traps
WAF on an NLB. Not supported.
Shield for SQL injection. That’s WAF.
Security groups for outbound domain filtering. They work on IPs; use Network Firewall.
A ski resort's lift-ticket store runs behind an Application Load Balancer protected by AWS WAF.
On the morning season passes go on sale, scripted clients send thousands of requests per minute each from changing IP addresses, and real customers see timeouts. Normal customers send fewer than 100 requests in five minutes.
The resort wants to automatically block any single IP address that sends far more requests than that.
What should a CloudOps engineer add?
Choose one answer.
AA. A network ACL on the load balancer's subnets with deny rules for the IP addresses seen in the access logs.
BB. Deny rules in the load balancer's security group for each IP address that sends too many requests.
CC. A rate-based rule in the web ACL that blocks any IP address whose request count over the evaluation window passes a set limit.
DD. An AWS Shield Advanced subscription so that the AWS Shield Response Team blocks the scripted clients for the resort.
D. Wrong: Shield Advanced adds DDoS protection and response support, but at significant cost and with a one-year commitment. A WAF rate-based rule handles request floods from individual addresses directly. Learn more: AWS Shield Advanced overview (opens in a new tab)
Explanation
AWS WAF rate-based rules track the request rate of each client IP address and block addresses that go over a threshold, for as long as they stay over it. They work at the application layer in front of the load balancer and need no manual address lists. Security groups cannot deny, and network ACLs are static and limited in size.
Want more on WAF, Shield and Network Firewall? The 5 full-length practice sets have 8 more WAF, Shield and Network Firewall questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →