AWS Shield & WAF

AWS Shield and AWS WAF together form the edge defence for internet-facing AWS workloads. Shield protects against L3 / L4 (network and transport) DDoS attacks; WAF inspects L7 (HTTP / HTTPS) traffic against managed and custom rules. Both services integrate natively with CloudFront, Application Load Balancer, API Gateway, and AppSync — the four AWS services that terminate internet traffic.

1. Edge Defence Layers

The traffic path: internet → Shield (always-on at the AWS edge) → CloudFront with a WAF Web ACL attached → origin (ALB / API Gateway / AppSync). Each layer drops different classes of attack so the origin only sees clean L7 traffic.

┌──────────────────────────────────────────────────────────────────────────────┐
│                       INTERNET / ATTACKERS                                   │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────────┐            │
│  │ Legitimate   │  │  L3/L4 DDoS  │  │  L7 App Attacks (SQLi,   │            │
│  │ Users        │  │ (SYN, UDP)   │  │  XSS, Bots, Scrapers)    │            │
│  └──────────────┘  └──────────────┘  └──────────────────────────┘            │
└──────────────────────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
┌──────────────────────────────────────────────────────────────────────────────┐
│               AWS SHIELD (Edge / Network DDoS)                               │
│  ┌──────────────────────────┐  ┌──────────────────────────────┐              │
│  │   Shield Standard        │  │   Shield Advanced ($3k/mo)   │              │
│  │   (Free, automatic L3/4) │  │   24x7 SRT, cost protection  │              │
│  └──────────────────────────┘  └──────────────────────────────┘              │
└──────────────────────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
┌──────────────────────────────────────────────────────────────────────────────┐
│               CLOUDFRONT + AWS WAF (L7)                                      │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────────┐           │
│ │  Managed     │ │  Rate-Based  │ │  Custom + Bot Control /      │           │
│ │  Rule Groups │ │   Rules      │ │  Captcha / Challenge         │           │
│ └──────────────┘ └──────────────┘ └──────────────────────────────┘           │
│   (Web ACL evaluation order: top-down, first terminating action)             │
└──────────────────────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
┌──────────────────────────────────────────────────────────────────────────────┐
│                ORIGIN (Application Tier)                                     │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────────┐            │
│  │     ALB      │  │ API Gateway  │  │  AppSync / Cognito       │            │
│  │  EC2 / ECS   │  │   Lambda     │  │  GraphQL                 │            │
│  └──────────────┘  └──────────────┘  └──────────────────────────┘            │
└──────────────────────────────────────────────────────────────────────────────┘

2. AWS Shield: Standard vs Advanced

Shield Standard is automatic and free for every AWS customer. It mitigates the most common volumetric L3/L4 attacks (SYN floods, reflection / amplification, UDP floods) at the AWS network edge with no configuration.

Shield Advanced ($3,000 / month per organization plus per-resource fees) adds:

Use Shield Advanced when downtime cost exceeds the subscription, when compliance demands documented DDoS mitigation, or when the cost-protection alone justifies the spend at high traffic.

3. AWS WAF Rule Groups

4. Integration with CloudFront / ALB / API Gateway / AppSync

A WAF Web ACL attaches to one or more of these AWS services. Each request hits the Web ACL before reaching the origin.

5. Web ACL Evaluation Order

Rules in a Web ACL are evaluated top-to-bottom by priority (lower number first). Each rule's action is one of Allow, Block, Count, Captcha, Challenge, or no terminating action (for label-only rules). The first terminating action wins:

  1. Block / Allow / Captcha / Challenge are terminating — once one fires, evaluation stops.
  2. Count is non-terminating — useful for shadow-testing a new rule before flipping it to Block.
  3. Default Action applies if no rule terminated — typically Allow for public sites, Block for allowlist-only APIs.

Common ordering pattern:


WebACL:
  DefaultAction: Allow
  Rules:
    - Priority: 10
      Name: AllowOurOffice
      Action: Allow
      Statement: { IPSetReferenceStatement: { ARN: ofc-ipset } }
    - Priority: 20
      Name: BlockKnownBad
      OverrideAction: None
      Statement: { ManagedRuleGroupStatement: { Name: AWSManagedRulesAmazonIpReputationList } }
    - Priority: 30
      Name: RateLimitPerIP
      Action: Block
      Statement:
        RateBasedStatement: { Limit: 2000, AggregateKeyType: IP }
    - Priority: 40
      Name: CommonRuleSet
      OverrideAction: None
      Statement: { ManagedRuleGroupStatement: { Name: AWSManagedRulesCommonRuleSet } }
    - Priority: 50
      Name: BotControl
      OverrideAction: None
      Statement: { ManagedRuleGroupStatement: { Name: AWSManagedRulesBotControlRuleSet } }

6. AWS Firewall Manager

Firewall Manager (a paid AWS Organizations service) is the right tool when you need a single team to enforce baseline WAF / Shield / Network Firewall / Security Group rules across many accounts.

Pricing: ~$100 per protected resource per month for Firewall Manager policies (plus the underlying WAF / Shield / Network Firewall costs). Worth it for security teams managing dozens of accounts; overkill for a single account.

↑ Back to Top

© Kevin Thomas Luzbetak, MSc