We close the content delivery chapter with protection against attacks. Your website is already fast (CloudFront) and encrypted (ACM), but the internet is full of malicious traffic: bots, hackers, attack attempts. The WAF (Web Application Firewall) is the shield that filters out that harmful traffic before it reaches your application. Integrated with CloudFront, it protects your site at the edge of the network.

A WAF (Web Application Firewall) is a firewall specialized in web applications. Unlike Security Groups (Chapter 4), which filter by ports and IPs at the network level, the WAF understands HTTP and examines the content of web requests to detect and block attacks.

Analogy: the WAF is like the security bouncer at a nightclub. He checks everyone who wants to enter: lets in regular customers, but stops those looking for trouble (those carrying weapons, the troublemakers). He inspects who enters and with what intention, not just the door.

The WAF defends against the most common web application attacks, many of them from the famous OWASP Top 10 (the list of the most critical web vulnerabilities):

• SQL Injection: attempts to "sneak in" malicious commands to your database through forms or URLs.
• Cross-Site Scripting (XSS): attempts to inject harmful scripts into your website to attack other users.
• Malicious bots: automated programs that crawl, copy content, or look for vulnerabilities.
• Brute force attacks: repeated attempts to guess passwords.
• Abusive request spikes: too many requests from the same source (rate limiting).

The WAF works with rules that define what to block and what to allow. There are two ways to get them:

AWS offers predefined rule groups maintained by their security experts. By enabling them, your website is protected against the most common threats, without you having to be a security expert. AWS constantly updates them as new threats appear.

To start, this is recommended: enable AWS managed rules (for example, the "Core" set and the "known bad inputs" set) and you'll have solid protection with very little effort.

You can also create your own rules for your specific case:

• Block or allow by IP: ban specific IPs or allow only certain ones (a blacklist or whitelist).
• Block by country (geo): if your business is only national, you can block traffic from countries where you only receive attacks.
• Rate limiting: "if an IP makes more than 1,000 requests in 5 minutes, block it." Excellent against bots and brute force.
• Filter by content: block requests with suspicious patterns in the URL, headers, etc.

Here's the advantage of combining WAF with CloudFront (subchapter 16.2): by putting it in the CDN, filtering happens at the edge of the network (the edge locations), far from your application.

Double benefit:

• Malicious traffic is blocked at the edge, before it travels to your server. Your application doesn't even notice the attack.
• Since filtering is distributed worldwide, it absorbs large-scale attacks without saturating your origin.

Real world example: an online store suffers a bot attack trying to test thousands of stolen cards on its payment form. With WAF integrated into CloudFront, a rate limiting rule detects massive requests from the same IPs and blocks them at the edge locations, far from the store. The store's servers continue to function normally for real customers, without even noticing the attack.

The WAF does not replace other protections; it adds to them, forming a defense in depth (a concept we will expand on in Chapter 23):

Each layer covers a different aspect. Together, they make your application much harder to attack.

• A WAF (Web Application Firewall) is a firewall that understands HTTP and filters malicious web traffic by examining the content of requests (unlike Security Groups, which filter by network). It's like the "security bouncer" of your website.
• It protects against common OWASP Top 10 attacks: SQL injection, XSS, malicious bots, brute force, and abusive spikes.
• It works with rules: AWS managed rules provide solid protection without being an expert (recommended to start), and you can add custom rules (block by IP/country, rate limiting...).
• Integrated with CloudFront, it filters malicious traffic at the edge of the network, far from your application, and absorbs large-scale attacks.
• The WAF is part of a layered defense along with Security Groups, Network ACLs, and IAM.

You've finished Chapter 16! Your application is now fast, secure, and protected for the internet. In Chapter 17 we close Part IV with containers on AWS: Docker, ECR, ECS, and EKS, another fundamental way to deploy applications.