Cloud Arena
Back to IAM & Security

AWS WAF & AWS Shield

aws

Layer 7 web application firewall, automated threat intelligence, and enterprise DDoS mitigation.

IAM & SECURITY
•Amazon Web Services

Layer 7 web application firewall, automated threat intelligence, and enterprise DDoS mitigation.

Click any section above to jump directly to it
GCP ➔ AWS Bridge
Fast-Track Mental Model Translation

Coming from Google Cloud?

Compare with Google Cloud Armor

Both provide enterprise Layer 7 Web Application Firewall rules, OWASP Top 10 defense, bot management, and multi-gigabit DDoS mitigation at edge load balancers.

What's Conceptually Identical
  • Layer 7 HTTP/HTTPS deep packet inspection for SQLi and XSS.
  • Rate limiting and IP allow/deny lists.
  • Pre-configured managed rule sets and DDoS mitigation.
Key Architectural Shifts in AWS
  • Architecture: AWS WAF binds to CloudFront, ALB, API Gateway, and AppSync; Cloud Armor binds to Google Cloud Global External Load Balancers.
  • DDoS Response: AWS offers Shield Advanced with 24/7 human response teams and cost protection; GCP offers Cloud Armor Managed Protection Plus.
  • Pricing: AWS WAF charges $5.00/Web ACL + $1.00/rule + $0.60/1M requests; Cloud Armor charges $5.00/policy + $1.00/rule + $0.75/1M requests.
Syntax & Command Translator
Create Web ACL / Security Policy
GCP:gcloud compute security-policies create edge-waf --description 'Edge WAF'
AWS:aws wafv2 create-web-acl --name edge-waf --scope REGIONAL --default-action Allow={}

What is AWS WAF & AWS Shield?

AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests forwarded to an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. AWS Shield provides managed Distributed Denial of Service (DDoS) protection that safeguards applications running on AWS across Layer 3, Layer 4, and Layer 7.

Decision Guide: When to Choose This Service

When to Use AWS WAF & AWS Shield

Use AWS WAF to protect web applications against SQL injection, cross-site scripting (XSS), abusive web scrapers, and Layer 7 HTTP floods; use AWS Shield for automatic Layer 3/4 DDoS protection.

When NOT to Use (Recommended Alternatives)

Do NOT use AWS WAF for simple port and IP blocking at the network transport layer (use Security Groups and Network ACLs).

Core Architectural Pillars

Layer 7 HTTP Inspection

Filters web traffic based on SQLi patterns, XSS tokens, geographical location, and header contents.

AWS Managed Rule Groups

Turnkey rule sets maintained by AWS Threat Intelligence (OWASP Top 10, Bot Control, Known Bad Inputs).

Rate-Based Rules

Automatically blocks or CAPTCHAs client IP addresses that exceed request rate thresholds (e.g. >500 req/5min).

AWS Shield Standard

Automatic, free Layer 3 and Layer 4 DDoS defense enabled across all AWS customers.

AWS Shield Advanced

Enterprise protection with 24/7 emergency response (SRT) and financial DDoS cost protection.