A global e-commerce company uses Amazon CloudFront to deliver its web application content. They have recently observed a significant increase in requests originating from known malicious IP addresses and botnets, leading to service degradation and potential security vulnerabilities. The company needs to implement a solution to filter these malicious requests at the edge, before they reach the origin servers, and protect against common web exploits. Which AWS service should they integrate with CloudFront?
- AAWS Web Application Firewall (WAF)
- BAmazon GuardDuty
- CAWS Shield Advanced
- DAWS Network Firewall
Show answer & explanationAnswer & explanation
Correct answer: A. AWS Web Application Firewall (WAF)
AWS WAF is a web application firewall that helps protect web applications or APIs from common web exploits that may affect availability, compromise security, or consume excessive resources. It can be integrated with CloudFront to filter malicious traffic at the edge, blocking requests based on IP addresses, geographical locations, and various web attack patterns before they reach the origin.
Why the other options are wrong
- B. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not actively block requests at the edge.
- C. AWS Shield Advanced provides enhanced DDoS protection but is not primarily designed for filtering general malicious IP addresses, botnets, or common web exploits like SQL injection or cross-site scripting.
- D. AWS Network Firewall is a managed firewall service for VPCs, designed to filter traffic at the network layer within a VPC, not at the CloudFront edge.
AWS WAF with CloudFront
AWS Web Application Firewall (WAF) helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. When integrated with CloudFront, it filters traffic at the edge location.
- Protects against common web exploits (e.g., SQL injection, XSS).
- Filters traffic based on rules (IP addresses, geo-match, rate-based).
- Integrates seamlessly with CloudFront, ALB, API Gateway, and AppSync.
Memory trick: WAF Watches Web Access, Filtering Foe.