WAF and Shield Overview

In this article, we explore two essential AWS services—Web Application Firewall (WAF) and AWS Shield—that work in tandem to secure your web applications and protect your infrastructure from various attacks.

Web Application Firewall (WAF)

WAF protects your web application by monitoring HTTP and HTTPS traffic at Layer 7. It defends against common threats such as SQL injection and cross-site scripting by inspecting incoming traffic and ensuring that only legitimate requests reach your application.

Key benefits of WAF include flexible rule sets, automatic scaling, and cost-effective monitoring. It supports the protection of RESTful APIs and web applications hosted on various AWS services such as Lambda, API Gateway, and EC2.

Use Cases and Integrations

WAF actively protects exposed endpoints operating over HTTP or HTTPS. It integrates seamlessly with services including:

• Amazon CloudFront (via a simple checkbox)
• API Gateway
• Application Load Balancer
• AWS AppSync
• AWS Cognito
• AWS App Runner
• AWS Verified Access

By filtering requests based on IP addresses, HTTP headers, URI strings, and geo-location, WAF helps safeguard your applications against common web attacks.

Components of WAF

WAF is composed of several key components managed via a centralized dashboard:

• Web ACLs: Define rules to either allow, block, or count a request.
• Rule Groups: Collections of rules that can be custom-defined or sourced from managed rule groups available through AWS or the AWS Marketplace.

Rules in WAF may filter requests based on several criteria:

• IP address
• HTTP header information
• HTTP body content
• Size constraints
• Geo-match (to block or allow traffic from specific regions)
• Rate limits (e.g., requests per hour)

When multiple rules are in place, their evaluation order (determined by rule priority) dictates whether a request is allowed, denied, or simply counted. Lower numeric priority values represent higher precedence. For example, CloudFront uses a simple checkbox integration, whereas an Application Load Balancer may require a region-specific WAF setup.

AWS also provides managed rule groups that offer baseline protections for various use cases including SQL databases, Linux operating systems, IP reputation lists, and fraud control measures.

Additional features include:

• IP reputation: Blocks traffic from known malicious sources.
• Fraud control: Prevents bot and malicious activity with CAPTCHA challenges.

AWS Shield

Transitioning to network-layer security, AWS Shield helps protect against Distributed Denial-of-Service (DDoS) attacks. DDoS attacks involve multiple compromised systems used by attackers to overwhelm services, often causing upset scaling costs.

AWS Shield is available in two variants:

• Shield Standard: A free service offered to all AWS accounts.
• Shield Advanced: A premium service that offers enhanced protection, access to the AWS security team, and automatic rule updates.

Shield Advanced can mitigate a variety of DDoS attack types, including:

• UDP reflection attacks: Exploit the stateless nature of UDP by spoofing requests.
• TCP SYN floods: Create incomplete connections that drain system resources.
• DNS query floods: Overwhelm DNS servers, disrupting service.
• Layer 7 attacks: Overload web servers with traffic, even when auto-scaling is active.

In a UDP reflection attack, spoofed UDP packets are sent to multiple reflectors, which then send a large volume of responses to the target, effectively causing an overload.

Shield Advanced is priced at approximately $36,000 per year with an annual commitment. It protects all AWS edge entry points, offers access to the DDoS Response Team (DRT), and automatically updates rules in your WAF and Firewall Manager as threats evolve.

Unlike WAF which focuses on Layer 7 protection, AWS Shield secures Layers 3, 4, and 7, covering IP, TCP, UDP, and HTTP attacks. Combining Shield with WAF creates a layered defense strategy, ensuring complete protection for both application and network layers.

Shield Advanced further enhances protection by offering proactive DDoS attack handling along with reviews from the Shield Response Team. This team provides custom network mitigations, optimized traffic management, and architectural guidance for frequently targeted infrastructures.

Conclusion

WAF and AWS Shield together deliver comprehensive security for your infrastructure. Here is a summary of their roles:

By integrating WAF and Shield with AWS components like CloudFront, API Gateway, and various load balancers, you ensure robust security and maintain high availability under attack conditions. This layered defense strategy is essential for sustaining service uptime and controlling costs.

Thank you for reading this article.