WAF and DDoS Protection

WAF rule sets (OWASP CRS), rate limiting, AWS Shield Standard vs Advanced, Cloudflare Magic Transit, and scrubbing centers.

Overview

Overview Web Application Firewalls (WAFs) and DDoS protection are two distinct but complementary defenses. A WAF operates at Layer 7 (HTTP) and inspects request content to detect and block application-layer attacks — SQL injection, XSS, path traversal, and other OWASP Top 10 threats. DDoS protection operates at Layers 3, 4, and 7 to absorb volumetric attacks that aim to exhaust bandwidth or compute capacity.

A WAF inspects individual HTTP requests and applies a set of rules (signatures, rate limits, geographic restrictions, IP reputation) to make a per-request decision to allow, block, or challenge. The OWASP Core Rule Set (CRS) is the open-source baseline used by ModSecurity, AWS WAF, and Cloudflare WAF. It contains hundreds of rules detecting common attack patterns.

AWS WAF protects ALBs, CloudFront distributions, API Gateway, and AppSync via Web ACLs containing rule groups. Rules are evaluated in priority order; the default action applies to requests matching no rules.

DDoS protection differs in scale and mechanism. A volumetric attack may send 1-10 Tbps of traffic. Effective DDoS protection requires absorbing or filtering traffic close to its source using a scrubbing infrastructure with global anycast presence and BGP-based traffic diversion.

AWS Shield Standard provides automatic protection against common Layer 3 and Layer 4 attacks for all AWS customers at no cost. AWS Shield Advanced adds SRT (Shield Response Team) support, protection for Elastic IPs and Route 53, cost protection, and Layer 7 DDoS protection. Cloudflare Magic Transit provides anycast-based DDoS protection for your own IP prefixes.

Key concepts

WAF (Web Application Firewall)
An L7 proxy that inspects HTTP request content and applies rules to allow, block, or challenge individual requests. Defends against OWASP Top 10 application-layer attacks. Does not defend against volumetric DDoS.
OWASP Core Rule Set (CRS)
An open-source collection of rules detecting SQL injection, XSS, path traversal, local/remote file inclusion, command injection, and other common web attacks. Used as the baseline by AWS WAF Managed Rules and Cloudflare WAF.
AWS Shield Standard vs Advanced
Shield Standard: automatic, free, protects all AWS resources from L3/L4 attacks. Shield Advanced: paid ($3K/month), adds L7 DDoS protection, SRT access, cost protection, Route 53 and Elastic IP protection.
DDoS Scrubbing
Traffic destined for a protected IP is diverted to a scrubbing center via BGP route advertisement. The scrubbing center filters malicious traffic using rate limiting, connection validation, and signature matching, then forwards clean traffic to the origin.
Rate Limiting
WAF rules that track request counts from a source IP over a time window and block or challenge sources exceeding a threshold. AWS WAF rate-based rules evaluate counts over 5-minute windows.

When to use it

  • Configuring AWS WAF on an ALB or CloudFront distribution to protect against OWASP Top 10 attacks
  • Evaluating AWS Shield Standard vs Advanced for a production workload
  • Designing a DDoS mitigation strategy for a high-value public-facing application
  • Implementing rate limiting at the WAF layer to prevent credential stuffing or API abuse
  • Explaining the difference between WAF and DDoS protection to a stakeholder

Interview questions

  • How do you configure AWS WAF on a CloudFront distribution to block SQL injection and rate limit API abuse?
  • Explain AWS Shield Standard vs Advanced and when you would recommend Shield Advanced.

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio