Network Protection and Cost Optimization
Verify that AWS WAF, Shield, Network Firewall, and DNS Firewall are actually enforcing something, then cut the NAT, data transfer, and endpoint charges that grow without anyone deciding they should.
Two questions land on a CloudOps engineer's desk regularly, and neither has an answer you can read off a console page. The first comes from compliance: is this account actually protected? The second comes from finance: what is this network line on the bill? This topic answers both, because both turn out to be the same kind of investigation, which is following a path and checking what happens at each point on it.
What This Topic Covers
- The 4 network protection services and the different traffic each one sees: AWS WAF on HTTP requests, Shield on DDoS, Network Firewall at the VPC perimeter, and Route 53 Resolver DNS Firewall on outbound DNS queries
- A repeatable audit frame that applies to all of them: is it deployed, is it attached to what you believe, is it enforcing or only observing, and can you prove what it did
- The configurations that make a control look healthy while permitting everything: web ACLs with no association, rule group overrides left on Count, Network Firewall routes that never send it traffic, and DNS Firewall rules still set to Alert
- The DNS Firewall settings that decide behavior under failure, including the fail-closed default and the SERVFAIL response
- The 3 shapes of network charge: hourly resource charges, per-GB processing charges, and per-GB data transfer charges, and how a single gigabyte picks up several of them
- Reading network spend from the usage type on a bill line, and knowing when to reach for Cost Explorer, the Cost and Usage Report, or VPC flow logs
- The arithmetic behind the common decisions: gateway endpoints against NAT gateways, interface endpoints against NAT gateways, one NAT gateway against one per Availability Zone, and Transit Gateway against peering
Why It Matters
Task 5.1 of SOA-C03 names both of these as skills in their own right, and both are written as operator work rather than design work. You are not asked to invent a firewall architecture; you are asked to check one and to explain a bill.
On the job the payoff is larger than the exam weight suggests. A protection service that was deployed and never switched from test mode is a control that exists on paper only, and it is the kind of gap that is discovered during an incident rather than before one. On the cost side, network charges are the ones nobody owns, because no single team provisioned them, and a NAT gateway processing traffic that a free gateway endpoint could carry is money spent for no benefit at all.