Two Different Threat Models
Network attacks come in two fundamentally different forms, and they require different defenses. Understanding the distinction is critical for both architecture decisions and interviews.
Volumetric attacks (DDoS): The attacker does not exploit a bug in your code. They simply send so much traffic that your servers cannot respond to legitimate users. Think of it as 10,000 people simultaneously trying to walk through a single door — the door is not broken, it is just overwhelmed. This is a Layer 3/4 problem (network and transport layers).
Application exploits: The attacker sends carefully crafted requests that exploit logic flaws in your application — SQL injection, cross-site scripting (XSS), path traversal. Each request looks like normal HTTP traffic but contains malicious payloads. This is a Layer 7 problem (application layer).
AWS Shield: DDoS Protection (Layers 3 & 4)
AWS Shield protects against volumetric DDoS attacks. It operates at the network edge, absorbing attack traffic before it reaches your infrastructure.
| Tier | Cost | What You Get |
|---|---|---|
| Shield Standard | Free (always on) | Automatic protection against SYN floods, UDP reflection attacks, and other common network-layer attacks. Applied to all AWS customers automatically. |
| Shield Advanced | ~$3,000/month + data transfer fees | DDoS Response Team (DRT) access 24/7, cost protection (AWS credits your bill for scaling costs incurred during an attack), enhanced detection, attack visibility dashboards, and protection for EC2, ELB, CloudFront, Route 53, and Global Accelerator. |
Shield Advanced is worth the cost for organizations with revenue-critical public-facing applications where a 30-minute outage costs more than the monthly fee.
AWS WAF: Application Firewall (Layer 7)
AWS Web Application Firewall (WAF) inspects HTTP and HTTPS requests and applies rules to allow, block, or count them. It operates at Layer 7, meaning it can read the URL path, query parameters, headers, cookies, and request body.
You configure WAF using Web ACLs (Access Control Lists), which contain ordered rules and rule groups:
Web ACL: my-app-waf
├── Rule 1: AWSManagedRulesCommonRuleSet (blocks OWASP Top 10)
├── Rule 2: AWSManagedRulesSQLiRuleSet (blocks SQL injection)
├── Rule 3: Rate-based rule (block IP if > 2000 requests / 5 minutes)
├── Rule 4: Geo-match rule (block requests from CN, RU, KP)
└── Default Action: Allow
Managed Rule Groups are pre-built rule sets maintained by AWS or third-party vendors (CrowdStrike, F5, etc.) that you can subscribe to. The AWS Managed Rules Common Rule Set covers the OWASP Top 10 vulnerabilities and is the standard starting point for any production WAF.
WAF can be attached to:
- CloudFront distributions (global edge protection)
- Application Load Balancers (ALB)
- API Gateway REST APIs
- AppSync GraphQL APIs
- Cognito User Pools
Creating a Web ACL is a single call: a name, a scope (regional or CloudFront), a default action, and an ordered array of rule objects — each rule a statement (what to match), an action (block, allow, or count), and a visibility config (which CloudWatch metrics and sampled requests to publish).
The analogy:
- Shield stops the mob from blocking the front door (volume).
- WAF checks the ID card and searches the bag of each person walking through the door (logic).