Edge protection with AWS WAF and Shield: SAA-C03 study notes and practice questions
What to know about Edge protection with AWS WAF and Shield for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 1 free question to test it. Part of the SAA-C03 study guide.
Edge protection questions name an attack or an unwanted kind of traffic and ask where to stop it. Match the attack to the layer.
AWS WAF
AWS WAF is a web application firewall for HTTP and HTTPS requests. You attach a web ACL to a CloudFront distribution, Application Load Balancer, API Gateway REST API, AppSync GraphQL API, Cognito user pool, App Runner service or Verified Access instance. It can’t attach to a Network Load Balancer or directly to EC2.
AWS Managed Rules cover common attacks: the core rule set, SQL injection, known bad inputs, IP reputation lists and Bot Control.
Rate-based rules block or count an IP address (or other key) that sends more than a set number of requests in a time window. That’s the answer to “one client is hammering the login page”.
Geo match rules allow or block by country; IP set rules allow or block specific ranges.
Logs go to CloudWatch Logs, S3 or Firehose.
AWS Shield
Shield Standard is on for every AWS customer at no extra charge and protects against common network and transport layer (layer 3 and 4) DDoS attacks.
Shield Advanced is a paid subscription that adds enhanced detection and mitigation for larger attacks on CloudFront, Route 53, Global Accelerator, load balancers and Elastic IPs, access to the Shield Response Team, and cost protection for scaling charges caused by an attack.
Firewall Manager
AWS Firewall Manager applies WAF rules, Shield Advanced protection, security group policies and Network Firewall policies across every account in an organization, including new resources as they appear.
How to choose
The scenario says
Look for
SQL injection or cross-site scripting attempts
AWS WAF with managed rule groups
One IP sending thousands of requests to an endpoint
WAF rate-based rule
Block traffic from specific countries
WAF geo match rule (or CloudFront geographic restrictions)
Large DDoS attacks, expert help, protection from attack-driven bills
Shield Advanced
The same rules across 50 accounts, applied automatically
Firewall Manager
Filter traffic leaving or entering a VPC by domain or with stateful inspection
AWS Network Firewall
Common traps
Putting WAF on a Network Load Balancer. Not supported; put CloudFront or an ALB in front.
Buying Shield Advanced for an application-layer attack such as SQL injection. That’s WAF’s job.
Using security groups to block a country or rate-limit. Security groups can’t do either.
An online ticketing company runs its public booking site on Amazon EC2 instances behind an Application Load Balancer.
Logs show automated clients sending SQL injection payloads in query strings, and single IP addresses sending thousands of requests within a few minutes when tickets go on sale.
The company wants to block both kinds of traffic before it reaches the instances, using managed protections where possible, without blocking normal customers.
Which solution meets these requirements?
Choose one answer.
AA. Associate an AWS WAF web ACL with the load balancer that uses the AWS managed SQL database rule group and a rate-based rule that counts by IP address.
BB. Subscribe to AWS Shield Advanced, add the load balancer as a protected resource, and turn on automatic application layer DDoS mitigation for it.
CC. Turn on Amazon GuardDuty and use an EventBridge rule to invoke a Lambda function that adds offending IP addresses as deny rules in the network ACL.
DD. Have a Lambda function read the load balancer access logs every minute and add deny rules for offending IPs to the load balancer's security group.
Show the answer and explanation
Answer: A
A. Right: Correct. AWS WAF inspects HTTP requests at the load balancer. The managed SQL database rule group blocks common SQL injection patterns, and a rate-based rule blocks any IP address that goes over a set number of requests in its evaluation window (5 minutes by default). Learn more: Rate-based rule statement (opens in a new tab)
C. Wrong: GuardDuty analyses CloudTrail, VPC flow logs and DNS logs, not the contents of HTTP requests, so it does not detect SQL injection. Network ACLs also hold a limited number of rules, and this is custom code to maintain. AWS WAF does both jobs as a managed service. Learn more: What is Amazon GuardDuty? (opens in a new tab)
D. Wrong: Security groups only support allow rules, so there is no way to add a deny rule for an address. The approach is also custom code, and it cannot spot SQL injection without parsing every request. AWS WAF handles both needs at the load balancer. Learn more: Security group rules (opens in a new tab)
Explanation
AWS WAF protects Application Load Balancers, CloudFront and API Gateway at the HTTP layer. AWS Managed Rules include a SQL database rule group for injection attempts, and rate-based rules block a single IP address that sends too many requests in a 1, 2, 5 or 10 minute window. Shield Advanced targets DDoS floods, GuardDuty only detects, and security groups cannot deny.
Want more on Edge protection with AWS WAF and Shield? The 5 full-length practice sets have 10 more Edge protection with AWS WAF and Shield questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →