AWS WAF, Shield and Edge Security

AWS Cloud & DevOps Engineering · Lesson 42 · Observability, Security and Reliability

Lesson Overview

A public API without an edge filter is a volunteer for scrapers, credential stuffing, and volumetric noise. TechLearningPro’s learner-facing surfaces—CloudFront distributions for lesson assets, Application Load Balancers and API Gateway stages for progress and quiz APIs—sit on the internet by design. AWS WAF inspects HTTP(S) requests against web ACLs (managed rule groups, rate-based rules, custom match statements) and allows, blocks, or counts. AWS Shield provides DDoS protection: Shield Standard is included with AWS for common network and transport layer protections on eligible services; Shield Advanced adds expanded detection, mitigation tooling, cost-protection features, and access to the Shield Response Team—verify current entitlements and pricing on AWS pages before any purchase decision. Edge security is the discipline of placing these controls where traffic first lands so origin compute never sees what should have died at the perimeter.

Amazon CloudFront and Edge Delivery taught distributions and origin access. API Gateway and Serverless APIs and Elastic Load Balancing and Route 53 placed Regional entry points. This lesson wraps those fronts with WAF and positions Shield correctly—without treating WAF as “install and forget security” or inventing undocumented rule APIs. Tag lab resources Project=tlp-lesson42. Set a budget alert before enabling WAF associations, logging destinations, or Shield Advanced evaluations. Clean up web ACLs, logging buckets/streams, and test associations when the lab ends.

Learning Objectives

1. Explain why edge inspection belongs in front of public TechLearningPro APIs and media distributions.
2. Define AWS WAF web ACLs, rules, rule groups, and association targets (CloudFront, ALB, API Gateway, and other supported resources per current docs).
3. Distinguish ALLOW, BLOCK, COUNT, and CAPTCHA/Challenge actions as documented for your WAF version and Region/scope.
4. Apply AWS Managed Rules thoughtfully—start in COUNT, then tighten—without blind copy-paste of every managed group.
5. Design rate-based rules for login, signup, and quiz-submit paths to blunt credential stuffing and abuse.
6. Position AWS Shield Standard vs Shield Advanced with honest scope: what each covers and what neither replaces.
7. Associate WAF with CloudFront for global edge enforcement and with Regional resources when the entry point is Regional.
8. Enable WAF logging to a supported destination and sample blocked requests for tuning without leaking secrets into logs.
9. Integrate edge findings with CloudWatch metrics and alarms from Amazon CloudWatch Metrics, Logs and Alarms.
10. Avoid false-confidence: WAF does not replace IAM, encryption (AWS KMS and Encryption Architecture), or application auth.
11. Plan IP allow/deny lists and geo statements only where product policy justifies them; document false-positive risk.
12. Estimate cost drivers (web ACL, rules, requests inspected, logging, Shield Advanced subscription if used) and verify live pricing.
13. Write an edge protection plan ADR for a public progress API behind CloudFront or ALB.
14. Troubleshoot blocked legitimate learners, missing associations, and logging gaps.
15. Clean up lab WAF resources and leave budgets enabled.
16. Preview how GuardDuty and Security Hub (next lesson) complement edge blocks with account-level threat detection.
17. Map edge controls to Well-Architected Security and Reliability lenses.
18. Prepare interview answers that separate L3/L4 DDoS myths from L7 application abuse.

Prerequisites

• Lessons 12–15: ALB, Route 53, CloudFront, API Gateway mental models.
• Module 4 signal literacy: CloudWatch metrics/logs/alarms (lesson 36) and incident basics (lesson 40).
• KMS awareness for log-bucket encryption (lesson 41).
• Sandbox AWS account; budget alert; least-privilege IAM for WAF and logging.
• Willingness to read current AWS WAF and Shield documentation for association scopes, managed rule group names, and pricing—course text refuses frozen unverified CLI flag folklore as gospel.

Detailed Core Concepts

Why edge security exists

Application authentication stops unauthorized users. Edge security stops unauthorized traffic patterns and many automated attacks before they consume origin CPU, database connections, and on-call attention. TechLearningPro’s Monday board traffic and exam-week spikes look like “good load” to autoscaling—and so do botnet floods that hammer /api/login. Without rate controls and signature-based filters at the edge, you scale the attack.

AWS WAF in one paragraph

AWS WAF is a web application firewall service. You create a web ACL, add rules (and managed rule groups), set a default action, and associate the web ACL with a supported resource. For CloudFront, WAF runs at AWS edge locations (scope: CloudFront / global as documented). For ALB, API Gateway REST API stages, and other Regional resources listed in current docs, you create Regional web ACLs in the resource’s Region. Requests matching rules take the rule’s action; unmatched traffic follows the default action.

Rule building blocks

Rules combine match statements: IP sets, geo match, size constraints, string/regex match on headers, query strings, URI paths, body (with size limits), SQLi and XSS managed statements, rate-based aggregates, and logical AND/OR/NOT compositions as supported. Prefer managed rule groups for common OWASP-style classes, then add custom rules for TechLearningPro path semantics (/api/auth/*, /api/quiz/submit). Always verify statement limits, body inspection size, and JSON body parsing options in current documentation—do not invent request-body features.

Managed rule groups

AWS and marketplace sellers publish managed rule groups (for example, core rule sets, known bad inputs, SQL database, Linux/Unix, anonymous IP lists—exact names and versions change). Best practice for TechLearningPro: attach in COUNT mode first, review sampled requests and metrics for a bake period, then switch offending rules or the group to BLOCK with a rollback plan. Blind BLOCK of every managed group on day one fails legitimate lesson-player traffic (user agents, rich text in forum posts, encoded URLs).

Rate-based rules

Rate-based rules track request rates from an aggregate key (commonly IP, with additional aggregation options documented for WAF). Use them on authentication and write-heavy paths. Choose thresholds from baseline metrics, not folklore numbers. Pair with application-level account lockout and MFA for login—edge rate limits are blunt instruments that also hit NAT-sharing corporate learners if keyed only by IP.

AWS Shield Standard and Advanced

Shield Standard automatically provides protections against many common, frequently occurring network and transport layer DDoS attacks for AWS services that are in scope—confirm current service coverage in Shield docs. You do not “turn on” Standard as a separate product for basic eligibility. Shield Advanced is a paid subscription with additional detection and mitigation capabilities, advanced event visibility, optional cost protection related to scaling during eligible attacks (verify current terms), and engagement with AWS experts during events. Shield does not replace WAF for Layer-7 application exploits (SQLi payloads, bad bots scraping curricula). WAF does not replace Shield for volumetric L3/L4 floods. Together they cover different layers.

CloudFront + WAF + Shield mental model

Viewers → CloudFront edge → WAF web ACL (L7 filters/rate) → cache or origin fetch → S3/ALB/API. Shield operates for DDoS on eligible resources; with Advanced, you gain deeper tooling during events. Origin security groups, OAC on S3, and IAM still matter—edge security is additive.

Logging and observability

Configure WAF logging to a supported destination (Amazon Kinesis Data Firehose delivery stream, Amazon S3 bucket, or Amazon CloudWatch Logs—confirm current options and formats). Redact or avoid logging full authorization headers and cookies containing session tokens. Alarm on BlockedRequests, elevated AllowedRequests anomalies, and rule-specific metrics. Feed high-severity patterns into the incident process from lesson 40.

What WAF is not

WAF is not API authentication. It is not a substitute for input validation in Lambda or ECS services. It is not a privacy program. It will not encrypt data at rest. Treat it as a perimeter filter with tunable false positives.

Architecture and Design Diagrams

mermaidCopy
flowchart LR
  Learner[Learner browser]
  Edge[CloudFront edge]
  WAF[AWS WAF web ACL]
  Shield[Shield Standard or Advanced]
  OriginAPI[ALB or API Gateway]
  OriginS3[S3 via OAC]
  Logs[WAF logs S3 or CW Logs]
  CW[CloudWatch metrics alarms]

  Learner --> Edge
  Shield -.-> Edge
  Edge --> WAF
  WAF -->|allow| OriginAPI
  WAF -->|allow cacheable| OriginS3
  WAF -->|block| Learner
  WAF --> Logs
  WAF --> CW

mermaidCopy
flowchart TB
  subgraph plan [Edge protection plan]
    Paths[Path inventory login quiz assets]
    Baseline[Baseline RPS per path]
    Count[Managed rules COUNT]
    Rate[Rate-based on auth write]
    Block[Promote BLOCK with rollback]
    Runbook[False-positive runbook]
  end
  Paths --> Baseline --> Count --> Rate --> Block --> Runbook

Request flow for a blocked credential-stuffing burst: many POSTs to /api/auth/login from one IP → rate-based rule threshold exceeded → BLOCK → 403 (or configured response) to client → metric BlockedRequests increments → optional SNS/ChatOps from CloudWatch alarm → on-call reviews samples; legitimate office NAT may need allowlist exception with expiry.

Technical Explanation

Association targets and scope

Create the web ACL in the correct scope. CloudFront associations use the CloudFront-scoped web ACL (managed through the appropriate console/API Region workflow documented by AWS—commonly configured in us-east-1 for CloudFront WAF). Regional ALB and API Gateway associations use Regional web ACLs in the same Region as the resource. Associating the wrong scope fails or never inspects traffic—verify with a deliberate allow-rule test request and metrics.

Default action vs rule order

Rules evaluate in priority order. First matching terminating action wins per WAF evaluation semantics in current docs. Default action applies when no rule terminates. Prefer explicit BLOCK/ALLOW on known paths plus a cautious default (often ALLOW with strong managed rules, or stricter defaults for admin-only distributions). Document the default in the ADR so future engineers do not “flip default to BLOCK” during an incident without understanding bypass paths for health checks.

Custom responses and labels

Where supported, custom response bodies and headers improve client UX for blocks (careful: do not leak rule IDs that help attackers). Labels from managed rules can feed subsequent rules—use for progressive filtering. Confirm label names from managed rule documentation versions you pinned.

IP sets and geo match

IP sets help allowlist CI runners or partner callbacks and denylist known abusers. Geo match can restrict admin consoles to expected countries—poor fit for a global learning platform’s public lesson API. If product requires geo restrictions for licensing, put the requirement in writing and test traveler false positives.

Bot control and CAPTCHA/Challenge

AWS offers managed bot-related capabilities and CAPTCHA/Challenge rule actions in WAF (availability and pricing are separate line items—verify current docs). Use for high-abuse flows (signup, password reset), not for every static asset GET. CAPTCHA on CloudFront asset paths destroys CDN value and learner UX.

Shield Advanced operational notes

If leadership evaluates Shield Advanced, document: covered resource types, onboarding steps per current docs, Route 53 health checks / acceleration features if used, runbooks for engaging support during events, and the subscription cost relative to TechLearningPro’s risk profile. Many education platforms start with Standard + strong WAF + autoscaling discipline; Advanced is a risk/cost decision, not a badge.

Performance

WAF adds inspection latency that is usually small relative to origin work, but complex regexes and large body inspections have limits. Keep rules focused. Cache static assets at CloudFront so WAF sees fewer origin-bound GETs for hashed JS/CSS after edge allow.

Security of the control plane

Who can update web ACLs is as sensitive as who can update security groups. Use IAM least privilege, CODEOWNERS for IaC that defines WAF, and change tickets for production BLOCK promotions. Log CloudTrail management events for wafv2 APIs (see AWS CloudTrail and Audit Logging).

Cost drivers (illustrative only)

Typical dimensions include web ACL charges, rules/rule groups, and requests inspected; logging storage/delivery; Shield Advanced monthly fee plus data-transfer related dimensions if subscribed. Illustrative classroom figures are not quotes—open the current AWS WAF and Shield pricing pages for your Region and record the date in lab notes.

Practical Implementation or Design Walkthrough

Problem

Create an edge protection plan for TechLearningPro’s public progress/quiz API and the CloudFront distribution that fronts public assets and (optionally) the API.

Steps

1. Confirm budget alert; tag Project=tlp-lesson42.
2. Inventory entry points: CloudFront distribution ID(s), ALB ARN(s), API Gateway stage ARNs.
3. Draft path matrix: public GETs (assets), authenticated APIs, login/signup, admin.
4. Create a web ACL (CloudFront scope for the distribution). Add one AWS Managed Rules group in COUNT. Add a rate-based rule for /api/auth/ (or your lab path) with a conservative threshold derived from a short baseline.
5. Associate the web ACL; send test traffic; confirm metrics.
6. Enable logging to a lab S3 bucket or CloudWatch Logs group with encryption and lifecycle; verify samples redact sensitive headers as configured.
7. Promote one low-risk rule to BLOCK; test a deliberate bad request and a good learner request.
8. Write ADR: COUNT→BLOCK policy, rate thresholds, false-positive rollback, Shield posture (Standard vs evaluate Advanced).
9. Cleanup: disassociate, delete lab web ACL/IP sets if unused, empty/delete lab log sinks, leave budget on.

Negative tests

• Oversized or obviously malicious query string matching a managed rule in BLOCK → expect block.
• Burst above rate limit on login path → expect eventual block for that aggregate key.
• Health check or monitoring IP accidentally blocked → fix with scoped allow rule and document.

Enterprise Real-World Scenarios

Exam-week scrape farm

Competitors scrape premium lesson HTML. Rate-based rules and bot controls on lesson paths, plus signed URLs for media (lesson 13), reduce bulk theft. Legal/product still needed—WAF is not DRM.

Credential stuffing on learner login

Stolen password lists hit /api/auth/login. Edge rate limits plus Cognito/IdP protections, MFA, and anomaly detection matter together. WAF alone is insufficient.

“Just block foreign countries”

A VP asks to geo-block all but one country to cut bots. Global learners and traveling instructors break. Prefer rate limits, auth, and managed bad-bot rules; geo only with product sign-off.

Incident: managed rule false positive

Forum posts with code samples trip SQLi signatures. Symptom: 403 on POST /api/forum. Fix: rule exception for that path or COUNT that signature; add regression fixture; never disable the entire managed group silently.

Shield Advanced evaluation after a scare

A volumetric event saturates a poorly cached origin. Post-incident, evaluate Advanced vs architecture fixes (CloudFront caching, anycast entry, larger rate limits). Often both: architecture first, Advanced if residual risk and budget align.

Best Practices

1. Inventory every public hostname and association target.
2. Start managed rules in COUNT; promote with evidence.
3. Rate-limit auth and write paths using measured baselines.
4. Prefer CloudFront + WAF for internet-facing learner GETs.
5. Log WAF decisions; encrypt and lifecycle the logs.
6. Alarm on block spikes and on sudden allow floods.
7. Version web ACL IaC; review changes like security group changes.
8. Pair with OAC, BPA, and private origins—edge is not origin auth.
9. Document false-positive rollback in the incident runbook.
10. Separate admin surfaces from public lesson distributions when possible.
11. Verify Shield scope; do not claim Advanced features without subscription.
12. Tag web ACLs and log buckets for FinOps (lesson 47).
13. Test after every CloudFront behavior change that alters paths.
14. Avoid CAPTCHA on static asset behaviors.
15. Rehearse communication: “blocked by security policy” UX copy.

Common Mistakes and Anti-Patterns

1. Associating a Regional web ACL to CloudFront (or the reverse).
2. Enabling every managed group in BLOCK on day one.
3. Rate limits so low that corporate NAT learners lock out.
4. Logging Authorization bearer tokens in plain text.
5. Believing WAF replaces application input validation.
6. No metrics/alarms—flying blind during an attack.
7. Permanent IP denylist without review.
8. Putting WAF only on ALB while CloudFront cache serves poisoned paths without inspection assumptions clarified.
9. Skipping cleanup—orphaned web ACLs and Firehose streams bill quietly.
10. Quoting outdated pricing or invented CLI flags in ADRs.

Troubleshooting and Design Review

Design review questions: Is every internet entry point associated? Is there a COUNT bake period recorded? Is rate-limit keyed correctly for your client topology? Is Shield expectation documented without marketing exaggeration?

Interview Questions and Answers

Q1: What problem does WAF solve? A: Inspect and filter HTTP(S) at supported edges/entry points to block or count abusive or malicious requests before they waste origin capacity.
Q2: Shield vs WAF? A: Shield focuses on DDoS protections (Standard included for eligible services; Advanced optional); WAF focuses on Layer-7 request rules. Complementary.
Q3: CloudFront vs Regional WAF? A: Match web ACL scope to the resource; CloudFront uses CloudFront-scoped ACLs; ALB/API Gateway use Regional ACLs.
Q4: Why COUNT first? A: Measure false positives before enforcing BLOCK.
Q5: Rate-based rule pitfall? A: Shared NAT IPs can punish many users; tune keys/thresholds and pair with app controls.
Q6: Does WAF authenticate users? A: No—use Cognito/IdP/IAM and application sessions.
Q7: Where do logs go? A: Supported destinations such as S3, CloudWatch Logs, or Kinesis Data Firehose—confirm current options.
Q8: Managed rule groups? A: Vendor-maintained rule bundles you attach and version-pin thoughtfully.
Q9: Geo blocking for a global LMS? A: Usually wrong for public lessons; maybe for admin-only.
Q10: Cost drivers? A: ACL, rules, requests inspected, logging, optional Shield Advanced—verify pricing pages.
Q11: How do you prove association works? A: Controlled test requests + BlockedRequests/CountedRequests metrics + log samples.
Q12: Relation to Security Hub? A: Edge blocks are preventive/detective at request time; Hub aggregates posture findings later (lesson 43).
Q13: Custom response bodies? A: Optional; keep generic; avoid leaking internals.
Q14: IaC tip? A: Treat WAF rules as production security code with review and fixtures.
Q15: First five minutes of a suspected L7 flood? A: Metrics, top rules, sample logs, rate-rule status, origin health—then tighten COUNT→BLOCK with communications.

Hands-On Exercises

Exercise: Edge protection plan for a public API

Deliverable: architecture sketch, web ACL design (managed group list in COUNT/BLOCK states, rate-based paths/thresholds), association evidence, one blocked and one allowed test, logging proof, cleanup transcript, ADR.

Challenge ADR

Leadership wants “Shield Advanced only, skip WAF” after reading a DDoS blog. Argue for layered L3–L7 controls with WAF on CloudFront for the lesson API, Standard always-on expectations clarified, and Advanced as a separate risk purchase.

Lab evidence checklist

• Budget alert screenshot
• Resource tags Project=tlp-lesson42
• Web ACL ARN and scope
• Association to distribution or ALB/API
• COUNT metrics sample
• BLOCK negative test
• Log delivery sample (redacted)
• Cleanup confirmation

Narrative: Monday board scrape

Anonymous clients pull /api/boards 100 RPS from few IPs. Rate-based BLOCK engages; CloudWatch alarm pages the platform channel; on-call confirms origin CPU flat; product later adds authenticated board APIs for write paths. Edge bought time.

Continuity

Previously: KMS and encryption architecture. Next: GuardDuty, Security Hub and Inspector for threat detection and posture aggregation beyond the HTTP edge.

Deep dive: path-specific rule strategy for TechLearningPro

Static hashed assets under /assets/* should rarely need aggressive SQLi body inspection—they are GETs of immutable objects. Focus managed rules and rate limits on /api/*, especially auth, password reset, grading submissions, and teacher upload APIs. If a single CloudFront distribution fronts both, use WAF scope statements (URI path) so asset traffic does not dominate inspected-request cost or false positives. Confirm path match syntax in current WAF docs (exact vs starts-with vs regex) before writing IaC.

Deep dive: header and cookie inspection caution

Matching on User-Agent can reduce naive bots and also break obscure browsers and in-app webviews used by enterprise customers. Prefer managed bot capabilities where licensed, plus auth. Never put long-term secrets in cookies that WAF logs might capture—session design belongs with the IdP lesson thread.

Deep dive: API Gateway Regional vs CloudFront fronting

Some TechLearningPro stacks terminate TLS at API Gateway Regional endpoints with WAF associated Regionally. Others put CloudFront in front of API Gateway or ALB for global entry and WAF at CloudFront. Trade-offs: caching, certificate management, WAF scope, and complexity. Document the chosen entry hostnames in the edge inventory; do not leave both public and only protect one.

Runbook snippet: false-positive rollback

1. Identify rule ID from logs/metrics.
2. Set that rule or group to COUNT (or add scoped exception) via IaC hotfix.
3. Communicate in status page language learners understand.
4. Add fixture request to CI regression if you maintain WAF integration tests.
5. Schedule follow-up to re-enable BLOCK with a narrower match.

Extended scenario: partner webhook allowlist

A curriculum partner sends webhooks to /api/webhooks/partner. Rate limits keyed by IP may block them during backfills. Use an IP set allow rule with higher priority for partner CIDRs, rotate CIDRs via ticketed IaC, and still validate signatures in the application—edge allowlist is not authentication.

Extended scenario: admin distribution separation

admin.techlearningpro.example on a separate CloudFront distribution with stricter WAF (geo optional, tighter rate limits, IP allow for office/VPN) reduces blast radius versus sharing the public learner distribution’s web ACL. DNS and certificate overhead is the trade.

Extended technical note: body inspection size

WAF inspects only a limited prefix of request bodies (document current limit for your rule type). Attackers may place payloads beyond the inspected window; application validation remains mandatory. For JSON APIs, enable JSON inspection features only as documented and tested.

Mapping to Well-Architected

Security: reduce attack surface at edge. Reliability: keep origins healthy during abuse. Performance: cache so inspection volume drops for static content. Cost: inspect what matters; lifecycle logs. Operational excellence: COUNT→BLOCK playbooks and IaC reviews.

Interview story to memorize

“We put WAF on the TechLearningPro CloudFront distribution, baked managed rules in COUNT for a week, rate-limited login, blocked a stuffing campaign with origin CPU unchanged, and kept Shield Standard expectations documented while Finance evaluated Advanced separately.”

Self-assessment rubric

Extended practice scenario 1 — 42 aws waf shield and edge security

Inventory every public hostname TechLearningPro exposes in your lab account and classify each as CloudFront, ALB, API Gateway, or other. For each, write whether a CloudFront-scoped or Regional web ACL applies. Catch at least one “forgotten” entry point (old lab ALB, unused stage). Budget and cleanup still mandatory if you create ACLs.

In a timed drill for edge WAF association and rate controls, implement or design the core lab with a partner observing. The observer stops any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, metrics or log output, and destroy/disable confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, CloudFront OAC from lesson 13, CloudWatch alarms from lesson 36, and CI promotion rules from Module 3. List two failure modes you simulated, including detection and fix. Estimate cost drivers and teardown timing.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps become flashcards.

Extended practice scenario 2 — 42 aws waf shield and edge security

Design rate-based thresholds using a one-hour baseline of legitimate login RPS (even if synthetic in lab). Propose warning and block thresholds with a rollback criterion. Do not copy blog numbers blindly.

In a timed drill for login path rate-based rules, implement or design the core lab with a partner observing. The observer stops invented APIs, secrets in repos, and skipped cleanup. Ten-line ADR plus evidence pack required.

Discuss NAT-sharing learner false positives and how application-level controls complement edge limits. Teach-back the overview; flashcard the gaps.

Extended practice scenario 3 — 42 aws waf shield and edge security

Attach one AWS Managed Rules group in COUNT only. Produce a one-page reading of counted rule metrics and three sample requests (redacted). Recommend which signatures could move to BLOCK.

Timed drill discipline, ADR, evidence, teach-back as in scenario 1, focused on managed rule bake-in.

Extended practice scenario 4 — 42 aws waf shield and edge security

Enable WAF logging to a lab destination with encryption and a short lifecycle policy. Prove a blocked request appears. Prove Authorization header handling is safe (excluded/redacted per your config).

Timed drill on WAF logging hygiene; cleanup Firehose/S3/Logs artifacts explicitly.

Extended practice scenario 5 — 42 aws waf shield and edge security

Write a comparative one-pager: Shield Standard (always-on expectations for eligible services) versus Shield Advanced (subscription features at high level). Include “what neither replaces.” No invented SLA numbers.

Timed drill on Shield positioning for leadership; ADR recommends buy or defer with criteria.

Extended practice scenario 6 — 42 aws waf shield and edge security

Simulate a false positive: deliberately BLOCK a rule that stops a legitimate POST with a code sample body. Execute the rollback runbook to COUNT. Document elapsed time to restore.

Timed drill on false-positive rollback MTTR.

Extended practice scenario 7 — 42 aws waf shield and edge security

Draft IaC pseudocode (CloudFormation, Terraform, or CDK resource names only—verify properties against current provider docs before apply) for web ACL + association. Peer review for scope mistakes.

Timed drill on WAF as code review.

Extended practice scenario 8 — 42 aws waf shield and edge security

Separate public vs admin distributions on paper. Assign different WAF strictness. Present trade-offs for certificates and DNS.

Timed drill on admin surface isolation.

Extended practice scenario 9 — 42 aws waf shield and edge security

Create an IP set allowlist for a pretend partner webhook CIDR and place an ALLOW rule at correct priority above rate limits. Still list application signature verification as mandatory in the ADR.

Timed drill on webhook allowlist without trusting network alone.

Extended practice scenario 10 — 42 aws waf shield and edge security

Build a CloudWatch alarm on blocked request sum and route to a lab SNS topic. Trigger with intentional bursts. Disable alarm on cleanup.

Timed drill on edge-to-alarm integration.

Extended practice scenario 11 — 42 aws waf shield and edge security

Compare protecting API Gateway directly (Regional WAF) versus CloudFront in front. Table latency, caching, certs, WAF scope, failure modes. Pick one for TechLearningPro progress API and justify.

Timed drill on entry architecture choice.

Extended practice scenario 12 — 42 aws waf shield and edge security

Produce a cost worksheet with line items labeled “verify on pricing page” for web ACL, rules, requests, logging storage, and optional Shield Advanced. Record the date you checked docs.

Timed drill on honest FinOps for edge security.

Extended practice scenario 13 — 42 aws waf shield and edge security

Red-team your own plan: list three ways an attacker bypasses your WAF (other hostname, non-HTTP vector, payload beyond body inspection window). Add compensating controls for each.

Timed drill on bypass brainstorming.

Extended practice scenario 14 — 42 aws waf shield and edge security

Write learner-facing status copy for a temporary stricter BLOCK mode during an active incident. Avoid technical jargon and rule IDs.

Timed drill on incident communications.

Extended practice scenario 15 — 42 aws waf shield and edge security

Map this lesson to Security Hub controls at a conceptual level (findings you might still see even with WAF). Preview lesson 43 triage.

Timed drill on edge vs account detection boundaries.

Extended practice scenario 16 — 42 aws waf shield and edge security

Review CloudTrail events for web ACL updates in a lab (if enabled). Show how a malicious ACL weaken would be audited.

Timed drill on control-plane audit for WAF.

Extended practice scenario 17 — 42 aws waf shield and edge security

Design CAPTCHA/Challenge placement only on signup and password reset behaviors; explicitly forbid on /assets/*. Cite UX and cache reasons.

Timed drill on selective challenge actions.

Extended practice scenario 18 — 42 aws waf shield and edge security

Given a multi-account Organization sketch, decide whether WAF is defined in a network account or workload accounts. Write accountability for rule changes.

Timed drill on multi-account edge ownership.

Extended practice scenario 19 — 42 aws waf shield and edge security

Create pass/fail fixtures: curl commands for allowed lesson GET, blocked bad query, rate-limit burst script outline (careful—only against your lab). Store in repo README for the lab.

Timed drill on regression fixtures for edge rules.

Extended practice scenario 20 — 42 aws waf shield and edge security

Evaluate marketplace managed rule groups at a conceptual level (extra cost, trust vendor updates). Decide allow/deny for TechLearningPro sandbox.

Timed drill on third-party rule group governance.

Extended practice scenario 21 — 42 aws waf shield and edge security

Tie edge blocks to SRE error budgets (lesson 40): when does BLOCK rate become an availability incident versus a success story?

Timed drill on SRE framing of WAF.

Extended practice scenario 22 — 42 aws waf shield and edge security

Document cleanup: disassociate, delete ACL, delete IP sets, delete log destinations, confirm billing dimensions quiesce over subsequent days (note delay in Cost Explorer).

Timed drill on complete edge lab teardown.

Extended practice scenario 23 — 42 aws waf shield and edge security

Explain to a new hire why OAC + WAF + Cognito are three different controls using one TechLearningPro request story.

Timed drill on layered control teach-back.

Extended practice scenario 24 — 42 aws waf shield and edge security

Draft interview answers Q1–Q15 aloud in under eight minutes. Peer grades precision on Shield vs WAF.

Timed drill on interview compression.

Extended practice scenario 25 — 42 aws waf shield and edge security

Full dress rehearsal: budget → inventory → ACL COUNT → associate → rate rule → log → one BLOCK → alarm → ADR → cleanup. Stopwatch each phase.

Timed drill on end-to-end edge protection lab.

Discuss Module 3 IaC gates: could cfn-guard/OPA require WAF association on public ALBs going forward? Note as a policy-as-code follow-up without inventing rule syntax.

Compliance evidence pack for auditors

Retain web ACL version (IaC commit SHA), association evidence, COUNT bake metrics, BLOCK change ticket, and log bucket retention settings. Auditors ask whether public APIs have application-layer protections beyond security groups—this pack answers with artifacts, not slogans.

Extended technical explanation: rule priority and terminating actions

Web ACL evaluation follows priority order from the lowest number (highest precedence) upward as documented for AWS WAF. A terminating action such as BLOCK or ALLOW ends evaluation for that request; non-terminating behaviors such as COUNT let evaluation continue so later rules can still match. This matters when you place an IP allowlist for partner webhooks above a broad rate-based BLOCK: the allow rule must terminate with ALLOW for those CIDRs, or the rate rule may still catch them depending on how you structured statements. TechLearningPro engineers should draw a priority ladder in the ADR: emergency deny IP sets, partner allows, path-specific rate rules, managed rule groups, and finally the default action. Mis-ordered ladders are a top cause of “we allowlisted them but they still get 403” tickets.

When promoting a managed rule from COUNT to BLOCK, change one signature or label-derived rule at a time during business-friendly hours, watch false-positive rates for twenty-four hours, then proceed. Bundle promotions only when a bake period already proved the whole group quiet. IaC pull requests should show the before/after priority table, not only a wall of JSON.

Extended technical explanation: CloudFront behaviors versus WAF path matches

CloudFront cache behaviors route paths to origins; WAF path matches decide inspection outcomes. They are complementary configurations that can drift. Example failure: a new behavior sends /v2/api/* to ALB while WAF rate rules still only match /api/*. Attackers and scrapers move to /v2/api/login and bypass your carefully tuned thresholds. The edge inventory must include behavior path patterns and WAF URI match strings side by side. A quarterly design review compares them. CI can dump distribution config and web ACL config into an artifact and fail on known drift patterns you encode—without inventing unsupported AWS “drift APIs,” a simple scripted diff of exported JSON is enough for many teams.

Extended technical explanation: metric dimensions that matter

AWS WAF publishes metrics such as AllowedRequests, BlockedRequests, CountedRequests, and PassedRequests (confirm exact names and dimensions in current CloudWatch metric documentation for WAF). Dimension by WebACL, Region/scope, Rule, and RuleGroup as available. Dashboards should show top rules by block volume, not only a single global blocked count—otherwise one noisy rule hides a second attack signature. During incidents, sorted rule metrics plus sampled logs beat guessing. Pair with origin metrics (ALB TargetResponseTime, HTTPCode_Target_5XX_Count, API Gateway 5XXError) to see whether the edge is protecting a healthy origin or masking an origin outage (clients may also see errors from origin failures that are not WAF blocks).

Extended enterprise scenario: acquisition of a second LMS brand

TechLearningPro acquires a smaller brand with its own CloudFront distribution and no WAF. Day-one control: associate a baseline web ACL in COUNT, identical managed groups to production, shared logging account sink, and a two-week bake before BLOCK. Do not copy production BLOCK rules on hour one—the acquired app’s query parameter conventions will differ. Product may also expose legacy admin paths on the public distribution; isolate them as in the admin separation scenario before aggressive blocking.

Extended enterprise scenario: teacher live classroom burst

A live cohort of five hundred teachers refreshes the same interactive board API from a conference Wi-Fi NAT. Rate-based rules keyed only by IP trip. Mitigation options: raise threshold temporarily with an incident ticket, switch aggregation keys if your WAF configuration supports more precise keys for authenticated APIs (verify current aggregation options), move the board API to authenticated per-user application rate limits, or provide a classroom egress IP allowlist for the event. Document which option you choose; never silently disable the rule and forget to re-enable.

Extended best practices deepener: staging web ACLs

Maintain tlp-waf-stage and tlp-waf-prod (illustrative names) or use IaC workspaces so experiments never edit production priorities live. Promote rule changes stage → prod with the same discipline as application deploys. Some teams attach the staging ACL to a staging distribution that replays a sanitized slice of traffic; others rely on synthetic suites. Either way, production is not your first COUNT laboratory for brand-new regex rules you wrote at midnight.

Extended best practices deepener: response code and client SDK behavior

Mobile and web SDKs for TechLearningPro must treat 403 from WAF differently from 401 from Cognito. A 401 means re-authenticate; a 403 from edge may mean “try later” or “contact support” without wiping tokens. Coordinate with client teams when you enable stricter modes. Custom response bodies with a stable JSON error code (EDGE_POLICY) help clients branch correctly—confirm custom response capabilities in current WAF docs before promising them in sprint commitments.

Hands-on narrative: measuring before and after

Capture a ten-minute baseline of AllowedRequests and origin request counts. Enable rate rules. Replay a lab burst generator against your sandbox only. Capture again. The success graph is flat or declining origin requests during the burst while BlockedRequests rises. If origin requests rise equally, association or path match is wrong. Save both graph screenshots in the evidence pack.

Hands-on narrative: intentional mis-association drill

In a throwaway lab, create a Regional web ACL and attempt the wrong association pattern to feel the failure mode (or study docs/error messages if the console prevents it). Write three sentences on how you would detect “WAF configured but not inspecting” in production: missing metric emission, CloudTrail showing no association, or distribution summary lacking web ACL ID. Detection design is part of the deliverable.

Module continuity paragraph

Lesson 13 placed CloudFront; lessons 14–15 placed compute entry; lesson 36 taught alarms; lesson 40 taught incidents; lesson 41 taught encryption for logs. Lesson 42 closes the open internet door with intentional filters. Lesson 43 asks what happens when threats bypass HTTP—compromised keys, anomalous API calls from inside, vulnerable AMIs—and how GuardDuty, Security Hub, and Inspector surface those without drowning you in email.

Final synthesis before summary

Edge security succeeds when inventory is complete, rules are measured before enforced, rate limits respect real learner topologies, Shield expectations are honest, logs are safe, and cleanup is habitual. TechLearningPro’s brand promise includes uptime during abuse events; WAF and Shield are how platform engineers keep that promise without pretending a firewall is a full security program.

Glossary drill (write definitions from memory, then check docs)

Web ACL; rule group; managed rule group; rate-based rule; IP set; geo match; COUNT vs BLOCK vs ALLOW; CloudFront scope vs Regional scope; Shield Standard; Shield Advanced; sampled request; web ACL association; default action; label (WAF); custom response. For each term, add one TechLearningPro sentence (“We use X when…”). This drill alone often surfaces misconceptions before the interview panel does.

Budget and cleanup sworn statement

Before marking the lab complete, write: “I verified the budget alert remains enabled. I disassociated and deleted lab web ACLs named ____. I deleted or lifecycle-expired lab log destinations ____. I will re-check Cost Explorer in three days for WAF/Shield line items.” Sign with your name and date. Instructors should reject labs missing this statement.

Self-assessment rubric detail

Score yourself honestly after the dress rehearsal. Any area under 70% becomes the next study block before attempting lesson 43 labs that assume edge controls exist. Bring the filled rubric to peer review; arguing about weights is less valuable than showing evidence rows for association, metrics, and teardown.

Pricing honesty footnote

Whenever an ADR mentions “Shield Advanced monthly fee” or “WAF request charges,” paste the URL of the pricing page you checked and the UTC date. Illustrative classroom dollars without that footnote fail this course’s FinOps hygiene early—lesson 47 will not accept folklore either.

Lesson Summary

AWS WAF gives TechLearningPro programmable Layer-7 filters and rate controls at CloudFront and Regional entry points; Shield addresses DDoS protections with Standard included for eligible services and Advanced as an explicit paid evaluation. Start managed rules in COUNT, rate-limit abuse-prone paths, log carefully, alarm loudly, and never confuse edge filters with authentication or origin hardening. Budget, tag Project=tlp-lesson42, and clean up lab ACLs and log sinks.

Next: GuardDuty, Security Hub and Inspector.

Further Reading

• AWS WAF Developer Guide
• AWS Shield
• AWS WAF pricing
• AWS Shield pricing
• Logging web ACL traffic
• AWS Managed Rules for AWS WAF
• Security best practices for AWS WAF
• CloudFront and AWS WAF