AWS WAF & Shield: Complete Guide to Web Application and DDoS Protection

Key Takeaway

AWS Shield Standard is free and protects against L3/L4 DDoS, while WAF blocks L7 web attacks (SQL injection, XSS, etc.). Shield Advanced provides paid advanced DDoS protection, SRT support, and cost protection. CloudFront + WAF combination is the best practice for edge defense.

AWS Shield

Shield Standard vs Advanced

Item	Shield Standard	Shield Advanced
Cost	Free (automatic)	$3,000/month + data transfer
Protection Layer	L3/L4	L3/L4 + L7
Applied To	All AWS resources	CloudFront, ALB, NLB, EC2, Global Accelerator, Route 53
DDoS Detection	Basic	Advanced (real-time visibility)
SRT Support	❌	✅ 24/7
Cost Protection	❌	✅ Credits for DDoS-induced scaling
WAF Integration	❌	✅ WAF cost included
Stateful Detection	❌	✅ Per-resource traffic baseline
Commitment	None	1 year

Shield Standard

Automatically applied to all AWS customers.

Protection Coverage:
- SYN/UDP Flood
- Reflection attacks
- Other L3/L4 DDoS attacks

Automatic detection + automatic mitigation (no user configuration needed)

Shield Advanced

Advanced protection against large-scale, sophisticated DDoS attacks.

Additional Features:
1. Real-time attack visibility (CloudWatch metrics)
2. Shield Response Team (SRT) 24/7 support
3. DDoS cost protection (scaling cost credits)
4. Automatic WAF rule creation (L7 DDoS mitigation)
5. Stateful detection (normal traffic baseline)

AWS WAF

What is WAF?

A Web Application Firewall that inspects HTTP/HTTPS requests and blocks malicious traffic.

Services WAF Can Be Applied To

Service	Protection Target
CloudFront	Block at global edge (recommended)
ALB	Regional web app protection
API Gateway	API endpoint protection
AppSync	GraphQL API protection
Cognito User Pool	Authentication endpoint protection

WAF Rule Types

1. Regular Rules

Inspect specific conditions to allow/block.

Condition	Description
IP Set	Allow/block specific IPs
Geo Match	Block by country
String Match	Inspect URI, headers, body
Regex	Pattern matching
Size Constraint	Request size limits
SQL Injection	Detect SQL insertion attacks
XSS	Detect cross-site scripting

2. Rate-Based Rules

Automatically block when same IP exceeds threshold in 5 minutes

Example: Over 2,000 requests in 5 minutes → Block IP
→ Effective for HTTP Flood DDoS defense

3. Managed Rule Groups

Pre-configured rules provided by AWS and AWS Marketplace partners.

Rule Group	Protection Target
Core Rule Set	Common web vulnerabilities (OWASP Top 10)
SQL Injection	SQL insertion attacks
Known Bad Inputs	Known malicious patterns
IP Reputation	Block malicious IPs
Bot Control	Bot traffic management
Account Takeover Prevention	Account takeover prevention

WAF Web ACL Structure

Web ACL (Web Access Control List)
│
├── Rule 1: AWS Managed Rules (Core Rule Set)    [Priority: 0]
│   → Action: Block
│
├── Rule 2: Rate-Based Rule (2000/5min)          [Priority: 1]
│   → Action: Block
│
├── Rule 3: Geo Block (specific countries)       [Priority: 2]
│   → Action: Block
│
├── Rule 4: IP Whitelist                         [Priority: 3]
│   → Action: Allow
│
└── Default Action: Allow

Multi-Layer Defense Architecture

Best Practice: CloudFront + WAF + Shield

[Internet]
    │
    ▼
[CloudFront] ← WAF Web ACL attached
    │            ├── Managed Rules (OWASP)
    │            ├── Rate-Based Rules
    │            └── Geo Block
    │
    │  Shield Standard (automatic, free)
    │  Shield Advanced (optional, paid)
    │
    ▼
[ALB] ← Additional WAF possible
    │
    ▼
[EC2 / ECS / Lambda]

Defense Layer Roles

Layer	Service	Defense Target
Edge (L3/L4)	Shield Standard	SYN Flood, UDP Flood
Edge (L7)	WAF on CloudFront	SQL injection, XSS, bots
Regional (L7)	WAF on ALB	Additional rule application
Advanced DDoS	Shield Advanced	Large-scale sophisticated attacks

WAF Cost Structure

Item	Cost
Web ACL	$5/month
Rule	$1/rule/month
Requests	$0.60/million
Managed Rule Groups	Varies by group

Example: 1 Web ACL, 5 rules, 10 million requests/month
- Web ACL: $5
- Rules: $5 (5 × $1)
- Requests: $6 (10 × $0.60)
- Total: $16/month

AWS Firewall Manager

Centrally manage WAF, Shield Advanced, and Security Groups across multiple accounts.

Organizations + Firewall Manager:

Management Account
└── Firewall Manager
    ├── WAF Policy → Apply to CloudFront/ALB across all accounts
    ├── Shield Advanced Policy → Apply to designated accounts
    └── Security Group Policy → Apply to VPC resources

SAA-C03 Exam Focus Points

1. ✅ Shield Standard: "Free, automatic, L3/L4 DDoS defense"
2. ✅ Shield Advanced: "Paid, SRT 24/7, DDoS cost protection"
3. ✅ WAF Targets: "CloudFront, ALB, API Gateway (NLB not supported)"
4. ✅ Best Practice: "CloudFront + WAF = edge defense"
5. ✅ Rate-Based Rules: "HTTP Flood defense"

Frequently Asked Questions

Q: Is Shield Standard sufficient?

For most common DDoS attacks, Shield Standard is sufficient. Only consider Shield Advanced when you need protection against large-scale attacks, SRT expert support, or cost protection.

Q: Can WAF be applied directly to NLB?

No. WAF can only be applied to L7 (HTTP/HTTPS) services. NLB is L4, so direct application is not possible. Consider placing CloudFront in front of NLB or switching to ALB.

Q: Does Shield Advanced activation include WAF?

Yes. Shield Advanced includes WAF usage costs. WAF Web ACL, rules, and request costs are included in the Shield Advanced subscription.

Q: How do I test WAF rules?

Set the rule action to Count mode to record match counts without actual blocking. After sufficient testing, change to Block.

Q: When should I use Firewall Manager?

When you need to consistently apply WAF rules or Shield Advanced across multiple AWS accounts. For a single account, it's simpler to configure WAF directly without Firewall Manager.

Related Posts

• Security Groups vs NACLs
• CloudFront Distribution Optimization
• AWS Organizations & SCP

References

• Building DDoS Protection with AWS Shield and WAF
• AWS WAF Developer Guide
• AWS Shield Features