What's changed: Added figure aws-genai-security (OWASP LLM risks → AWS mitigations) to the gen-AI security section s4. The cloned base chapters inherit SCS-C02 figures; s4 was the only section lacking one, now filled.
3.2Edge Protection and DDoS Mitigation
Understand application-edge defense—WAF, Shield (Standard/Advanced), CloudFront, Route 53, Firewall Manager, and Network Firewall. Protect apps from L7 attacks and DDoS.
At the internet edge, L7 attacks and DDoS are threats. Defend in layers with WAF, Shield, and edge delivery.
3.2.1Edge defense composition
- WAF: block malicious L7 HTTP (SQLi/XSS/rate limits) via rules.
- Shield: Standard auto-mitigates common DDoS (free), Advanced adds advanced protection + response support.
- CloudFront/Route 53: edge delivery and DNS; combine with WAF/Shield to shrink attack surface.
- Firewall Manager / Network Firewall: FM centrally applies across accounts, Network Firewall does stateful VPC inspection.
Common on SCS-C02: block L7 attacks (SQLi/XSS) = WAF, DDoS auto-mitigation = Shield (Advanced for higher), central WAF/SG rules across accounts = Firewall Manager, stateful VPC inspection = Network Firewall. WAF attaches to CloudFront/ALB/API Gateway.
SCS-C02 edge defense probes "layering the right service per attack layer." AWS WAF protects at L7 (HTTP/HTTPS), bundling managed rule groups (OWASP Top 10 / known bad IPs / bot control) and custom rules (rate limiting, geo blocking, string/regex match, size constraints) into a Web ACL attached to CloudFront, ALB, API Gateway, AppSync. Shield handles DDoS: Standard auto-mitigates common L3/L4 attacks for free, while Advanced adds mitigation of large/sophisticated attacks, DDoS cost protection (refunds attack-driven scaling charges), 24x7 SRT (Shield Response Team), and integration with Global Accelerator/Route 53/CloudFront. CloudFront caches and terminates TLS at the edge and hides the origin with OAC (Origin Access Control) to forbid direct access, shrinking attack surface. Network Firewall performs stateful traffic inspection/filtering in the VPC (domain allow-lists, IPS), and Firewall Manager centrally applies/enforces WAF/Shield Advanced/SG/Network Firewall policies org-wide, auto-applying to new accounts. The key is to layer L7 = WAF, DDoS = Shield, stateful VPC inspection = Network Firewall, org-wide enforcement = Firewall Manager, and hide the origin for minimal exposure.
| What to protect | Service | Key point |
|---|---|---|
| Malicious L7 requests | AWS WAF | Managed/custom rules; rate limit; Web ACL |
| DDoS (volumetric/protocol) | Shield | Standard free; Advanced adds SRT + cost protection |
| VPC traffic inspection | Network Firewall | Stateful; domain allow-list/IPS |
| Org-wide enforcement | Firewall Manager | Auto-apply WAF/Shield/SG policies |
Scenario: A public web app faces SQLi attacks and intermittent DDoS. Defend in layers and prevent direct attacks on the origin. → Front with CloudFront, block app-layer attacks with WAF (managed rules + rate limiting), and mitigate large DDoS with Shield Advanced (SRT support, cost protection). Restrict the origin ALB to allow only CloudFront via OAC/SG, blocking direct access. Centrally apply WAF rules org-wide with Firewall Manager.
FAQ: Shield Standard vs Advanced? Standard is free for all AWS customers and auto-mitigates common L3/L4 DDoS against CloudFront/Route 53/ELB. Advanced is paid, adding mitigation of larger/sophisticated attacks, real-time visibility, the SRT (24x7 response team), and DDoS cost protection (refunds for attack-driven scaling). For mission-critical needs with SLAs or cost protection, use Advanced.
Exam trap: Using Shield to "block L7 attacks like SQLi/XSS" is wrong—Shield is for DDoS (mainly L3/L4), while L7 request rules are WAF. Conversely, defending "large volumetric DDoS" with WAF alone is insufficient—Shield is needed. They are complementary. Also, WAF only works once attached to CloudFront/ALB/API Gateway, not standalone.
3.2.2Section summary
- L7 defense = WAF / DDoS = Shield (Standard/Advanced)
- Central apply = Firewall Manager / VPC inspection = Network Firewall
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Block SQL injection and malicious L7 requests to a web app. What?
Q2. For large DDoS attacks, you want advanced protection and AWS response support. What?
Q3. Centrally apply/enforce WAF rules and SG policies across many accounts. What?