The Secret Life of AWS: The Bodyguard (AWS WAF & Shield)

Part 24 of The Secret Life of AWS

Timothy was smiling as he looked at his dashboard.

"Look at this, Margaret," he said, pointing to the screen. "My new marketing campaign must be working. I have 10,000 requests per minute hitting the Checkout API."

Margaret leaned in, her expression curious but cautious. "That is impressive growth, Timothy. But… look at the error rate."

Timothy frowned. He clicked deeper. "That's strange. 90% of them are 400 Bad Request. And they are all coming from the same block of IP addresses."

"And look at the payload," Margaret said gently. "They aren't sending order data. They are sending gibberish code, trying to trick your database."

Timothy's face fell. "It's not customers. It's an attack."

"It appears to be a botnet," Margaret agreed softly. "And because your Lambda functions are trying to process every single request, your bill is going to be quite high."

"I need to shut it down," Timothy said, reaching for the keyboard. "I'll take the API offline."

"We don't need to close the store," Margaret said, placing a hand on his shoulder. "We just need to put a security guard at the door."

"We need AWS WAF."

The Front Door

Margaret navigated to the AWS WAF (Web Application Firewall) console.

"Right now, your API Gateway is open to the world," she explained. "Anyone who has the address can walk right in and talk to your Lambda functions."

"Think of WAF as a bodyguard standing outside the club," she said. "He checks everyone before they get in. If they look suspicious, or if they are causing trouble, he stops them on the sidewalk. They never even make it inside to disturb the guests."

"And because WAF sits at the Edge," she added, "it blocks the request before it reaches your API Gateway. That means the bad traffic never triggers your Lambda functions. You stop the attack before it hits your compute bill."

The Rules

"But how does the bodyguard know who is bad?" Timothy asked.

"We give him a list of Rules," Margaret said. She clicked Create Web ACL.

1. The Rate Limit "First, let's stop the flooding," she said. "We can set a Rate-Based Rule. If any single IP address sends more than 100 requests in 5 minutes, block them."

"That stops the brute-force attacks," Timothy noted.

2. The Managed Rules "Next, we use Amazon's intelligence," Margaret said. She enabled the AWS Managed Rules. "Amazon maintains a list of known bad actors, SQL injection patterns, and malicious bots. We can just subscribe to that list."

"So I don't have to write the security logic myself?" Timothy asked.

"Exactly," Margaret smiled. "Amazon sees attacks across the entire world. They update the list, and your bodyguard gets smarter automatically."

The Shield

"What about the really big attacks?" Timothy asked. "I've heard of DDoS attacks that can knock entire networks offline."

"That is a different kind of attack," Margaret explained. "WAF is our intelligent bodyguard checking IDs at the door. But what if someone tries to collapse the building by ramming a thousand trucks into it?"

"For that, we need structural protection," she said. "We need AWS Shield."

"Shield Standard is built into AWS automatically," she explained. "It protects you from the most common network layer attacks (Layer 3 and 4) at no extra cost. It is like an invisible force field around the entire data center."

"So between Shield (the force field) and WAF (the bodyguard), we are covered?"

"Precisely," Margaret nodded.

The Calm

Timothy applied the WAF rules to his API Gateway.

He watched the dashboard. The blue line (Total Requests) stayed high, but the green line (Lambda Invocations) dropped back to normal.

"Look," Timothy pointed. "The traffic is still hitting us, but WAF is blocking it. My application is quiet again."

"And your bill is safe," Margaret added.

Timothy sat back, relieved. "I built the system (Ep 1–18), I decoupled it (Ep 19–21), and I learned to debug it (Ep 23). But I forgot to protect it."

"You didn't forget," Margaret assured him. "You just reached the next level of maturity. A Junior Engineer builds features. A Senior Engineer protects them."

Timothy watched the 403 Forbidden count rise on the WAF dashboard. It was the most beautiful error message he had ever seen.

Key Concepts

• AWS WAF: A firewall that filters HTTP traffic based on customizable rules (IP, Rate Limit, SQL Injection).
• AWS Shield: Managed DDoS protection. Standard is automatic; Advanced offers more for high-stakes applications.
• Defense at the Edge: Blocking malicious traffic at the network edge to protect applications and control costs.
• Rate Limiting: A fundamental WAF rule to stop brute-force attacks by limiting request rates from a single source.

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.