AWS Network Protection Services

Protecting the network perimeter

Every application that accepts traffic from the internet has a perimeter, the point where outside requests first reach your resources. That perimeter is where attackers probe first, so AWS offers several services that filter and absorb unwanted traffic before it can hurt your application.

These services work at different layers. Some absorb floods of traffic aimed at knocking your site offline. Some read individual web requests and block the malicious ones. Some inspect traffic moving inside your private network. You often use more than one at the same time, because each one stops a different kind of threat.

AWS Shield: DDoS protection

A Distributed Denial of Service (DDoS) attack tries to overwhelm your application with a flood of traffic from many sources at once, so real users can no longer reach it. AWS Shield is the managed service that defends against these attacks.

Shield Standard

Shield Standard is automatic and free for every AWS customer. You do not enable it or pay for it. It defends against the most common network and transport layer attacks, known as Layer 3 and Layer 4 attacks, that target your website or applications. When you use it with Amazon CloudFront and Amazon Route 53, you get strong protection against all known infrastructure-layer attacks.

Shield Advanced

Shield Advanced is a paid subscription for applications that need more. It adds detection and mitigation for large and sophisticated DDoS attacks, including attacks at the application layer (Layer 7). It protects resources such as Amazon EC2, Elastic Load Balancing, CloudFront, Route 53, and AWS Global Accelerator.

Shield Advanced also gives you near real-time visibility into attacks, 24x7 access to the AWS Shield Response Team, and protection against the cost spikes that an attack can cause on protected resources. If your site is a frequent target or downtime would be expensive, Shield Advanced is worth the cost.

AWS WAF: filtering web traffic

AWS WAF is a web application firewall. While Shield absorbs traffic floods, WAF looks at individual HTTP and HTTPS requests and decides whether to allow, block, or count each one based on rules you set.

WAF defends against common web exploits such as SQL injection and cross-site scripting (XSS). You can write rules based on the IP address a request comes from, the country of origin, values in request headers, the length of a request, or strings in the request body. You can also start fast with managed rule groups from AWS, including sets that address the OWASP Top 10 risks and rules that block bad bots.

WAF protects resources that serve web traffic, including Amazon CloudFront distributions, Application Load Balancers, Amazon API Gateway REST APIs, and AWS AppSync GraphQL APIs. A blocked request gets an HTTP 403 (Forbidden) response instead of your content.

AWS Network Firewall: protecting your VPC

AWS Network Firewall is a managed service that filters network traffic for the subnets in your Amazon VPCs. While WAF works on web requests reaching public-facing resources, Network Firewall sits inside your private network and controls traffic flowing in and out of it.

It gives you fine-grained control with a flexible rules engine. You can block outbound requests to known bad domains, run an intrusion prevention system that inspects traffic for known exploits, and filter web traffic by URL or domain name. It scales automatically with your traffic, so you do not manage any firewall infrastructure yourself.

AWS Firewall Manager: managing protection at scale

Setting up Shield Advanced, WAF, and security groups one account at a time does not scale when a company runs dozens of AWS accounts. AWS Firewall Manager solves that problem. It is a central management service that lets you configure firewall rules once and apply them across every account and resource in your AWS Organization.

Firewall Manager can manage AWS WAF rules, Shield Advanced protections, Amazon VPC security groups and network ACLs, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall. When someone creates a new account or resource, Firewall Manager automatically brings it under the same security policies, so nothing slips through unprotected.

How these services fit together

The pattern is layered defense. Shield absorbs the flood, WAF blocks the bad request, Network Firewall controls traffic inside your VPC, and Firewall Manager keeps all of it consistent across your accounts.

Exam tips

• Shield Standard is free and automatic for everyone, and it covers common Layer 3 and 4 DDoS attacks. Shield Advanced is paid and adds Layer 7 protection, the Shield Response Team, and cost protection.
• AWS WAF filters web requests and blocks exploits like SQL injection and cross-site scripting. If a question mentions HTTP requests, web exploits, or the OWASP Top 10, the answer is WAF.
• AWS Network Firewall protects traffic at the VPC level, not individual web requests.
• AWS Firewall Manager is about central management across many accounts in AWS Organizations. If a question asks how to enforce the same rules across all accounts, the answer is Firewall Manager.