WAF, Shield, and Network Firewall

Protecting your applications from network-based attacks requires multiple layers of defence. AWS provides three complementary services: AWS WAF (Web Application Firewall) filters layer-7 HTTP traffic based on rules to block application-layer attacks. AWS Shield protects against DDoS (Distributed Denial of Service) attacks at layers 3 and 4. AWS Network Firewall is a stateful network firewall for VPC-level traffic inspection and filtering. Together, they address different threat vectors and are typically deployed together for comprehensive protection.

AWS WAF filters HTTP/HTTPS requests based on rules you define. WAF integrates with CloudFront, ALB, API Gateway, AppSync, and Cognito. Rules can match on: IP address sets (block/allow specific IPs), geo-match (block requests from specific countries), rate-based rules (block IPs exceeding a request rate — flood protection), managed rule groups (pre-built rules for OWASP top 10, AWS Threat Intel, Bot Control), and custom rules (match on any HTTP component). WAF ACLs (Web ACL) contain rules and apply to one or more resources.

AWS Managed Rule Groups are pre-built WAF rule sets maintained by AWS that protect against common threats without requiring you to write individual rules. Key groups: AWSManagedRulesCommonRuleSet — protects against OWASP top 10 (SQL injection, XSS, RFI, LFI). AWSManagedRulesKnownBadInputsRuleSet — blocks known bad input patterns. AWSManagedRulesAmazonIpReputationList — blocks IPs with bad reputation (botnets, compromised). AWSManagedRulesBotControlRuleSet — detects and blocks scraper bots and automated browsers. Most WAF deployments start with these managed groups before adding custom rules.

Rate-based rules in AWS WAF automatically block IP addresses that exceed a configurable request rate threshold within a 5-minute window. This protects against: HTTP flood attacks (overwhelming your servers with requests), brute force attacks (many login attempts), and API abuse (scraping or enumeration). You can aggregate by IP, by IP + request path (rate-limit a specific endpoint like /login), or by custom headers. Blocked IPs are automatically unblocked when their rate drops below the threshold — no manual intervention needed.

AWS Shield Standard is automatic DDoS protection included for all AWS customers at no additional cost. It protects against the most common layer 3 (network) and layer 4 (transport) DDoS attacks — SYN floods, UDP floods, reflection attacks. AWS Shield Advanced provides enhanced protection for layer 3, 4, and 7 attacks on EC2, ALB, CloudFront, Global Accelerator, and Route 53. Shield Advanced includes: AWS DDoS Response Team (DRT) support, cost protection (DDoS-related scaling charges are refunded), real-time metrics, and advanced attack forensics. Shield Advanced costs $3,000/month plus a data transfer fee.

AWS Network Firewall is a stateful, managed network firewall service deployed in your VPC to inspect and filter traffic. Unlike Security Groups (stateful, resource-level) and NACLs (stateless, subnet-level), Network Firewall provides: Deep packet inspection (DPI), stateful connection tracking, domain filtering (block by domain name or pattern), IPS (Intrusion Prevention System) rules using Suricata-compatible rule format, and egress filtering (control what your EC2 instances can call on the internet). Deploy Network Firewall in a dedicated firewall subnet in each AZ.

Network Firewall uses rule groups to define filtering logic. Stateless rule groups process packets without tracking connections — similar to NACLs but more flexible. Stateful rule groups track TCP connection state and inspect complete HTTP/TLS sessions. You can write rules in three ways: 5-tuple rules (source IP, destination IP, protocol, source port, destination port), domain list rules (allow or deny by FQDN), and Suricata-compatible IPS rules (the most powerful — pattern matching, protocol inspection). AWS provides managed rule groups for common threats.

The three services address different use cases and are complementary, not alternatives: WAF — layer-7 HTTP inspection, blocks application attacks (SQLi, XSS), rate limiting, bot control. Deployed at CloudFront or ALB. Shield — DDoS mitigation, protects infrastructure from volumetric attacks. Shield Standard is always on; Advanced adds team support. Network Firewall — layer 3-7 VPC traffic control, stateful inspection, domain filtering, IPS/IDS. Deployed inside VPC subnets. Use all three together: Network Firewall controls VPC-level traffic, WAF filters application requests, Shield mitigates DDoS.

WAF can log all sampled requests (1 in 5) or all requests to CloudWatch Logs, S3, or Kinesis Data Firehose. Logs include the full request headers, the IP address, country, which rules matched, and the action taken (ALLOW/BLOCK/COUNT). Use WAF logs to: Investigate attacks — see exactly what requests were blocked. Tune rules — identify false positives (legitimate requests being blocked) and add exceptions. Detect new threats — patterns in blocked requests may reveal new attack vectors. Enable COUNT mode for new rules before switching to BLOCK to validate they don't block legitimate traffic.

Deploying AWS WAF correctly requires understanding where to attach it in your architecture. For internet-facing applications, attach WAF to CloudFront so inspection happens at the edge before traffic reaches your origin — this blocks attacks before they consume origin bandwidth. For internal APIs or when CloudFront is not used, attach WAF to the ALB. For APIs exposed via API Gateway, WAF can be attached at the API Gateway level. You can attach WAF to multiple resources simultaneously — a CloudFront distribution AND the ALB behind it — for defence in depth, though this doubles inspection costs.

AWS Firewall Manager centralises WAF, Shield Advanced, Network Firewall, and security group policies across all accounts in an AWS Organization. Define WAF rules once in Firewall Manager and they automatically apply to all ALBs, CloudFront distributions, and API Gateways in all member accounts — including newly created resources. If a member account deploys a new ALB, Firewall Manager automatically associates the WAF Web ACL. This ensures consistent security policy enforcement across the organisation without relying on individual teams to configure WAF correctly.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: AWS WAF filters layer-7 HTTP traffic to block SQL injection, XSS, bots, and rate-limit abusive IPs, Shield Standard provides automatic layer-3/4 DDoS protection while Shield Advanced adds response team support and cost protection, and Network Firewall provides stateful VPC-level traffic inspection with domain filtering and IPS rules. Firewall Manager enforces policies across all accounts in an Organisation. Congratulations on completing the Security Architecture section!