Every public-facing web application receives traffic it never asked for — scanners probing for vulnerabilities, bots scraping content, and occasionally, a deliberate attempt to take the site down. AWS WAF and Shield are the two services built specifically to handle that traffic before it reaches your application.
AWS WAF — Filtering Requests Before They Reach You
WAF (Web Application Firewall) sits in front of your application — typically attached to CloudFront, an Application Load Balancer, or API Gateway — and filters incoming requests based on rules you define.
- Blocks common attack patterns like SQL injection and cross-site scripting
- Rate-limits requests from a single IP address to stop brute-force and scraping attempts
- Uses AWS Managed Rule Groups for known threats, without you having to write rules from scratch
- Can block traffic by geography, IP reputation, or specific request patterns unique to your application
AWS Shield — DDoS Protection
Shield protects against Distributed Denial of Service attacks, where attackers flood your infrastructure with traffic to make it unavailable.
- Shield Standard — automatically enabled at no extra cost, protects against common network-layer DDoS attacks
- Shield Advanced — paid tier with enhanced detection, 24/7 access to AWS’s DDoS response team, and cost protection for scaling charges incurred during an attack
Most small and mid-sized businesses are adequately covered by Shield Standard combined with a properly configured WAF. Shield Advanced becomes worth the cost for businesses where downtime has a direct, significant revenue impact.
Setting This Up Properly
- Attach WAF to CloudFront rather than directly to the origin, so filtering happens at the edge
- Start with AWS Managed Rules for OWASP Top 10 protections, then add custom rules for your application’s specific patterns
- Enable WAF logging to CloudWatch or S3 so you can review blocked requests and refine rules over time
- Set rate-based rules on login pages and forms specifically — these are the most common targets
What Gets Missed
- Enabling WAF but never reviewing the logs, so misconfigured rules silently block legitimate traffic
- Applying rules that are too broad and creating false positives that frustrate real users
- Assuming Shield Standard alone protects application-layer attacks — it primarily covers network and transport layer threats, WAF handles the rest
Together, WAF and Shield form the first layer of defense for anything public-facing. Neither replaces good application security practices, but both stop a large share of attacks before your application ever has to deal with them.
