Security, Identity, and Compliance
AWS Shield and AWS WAF
Complementary protections: AWS Shield addresses distributed denial-of-service attacks, while AWS WAF filters web requests using application-layer rules.
Key points
- Shield Standard provides baseline DDoS protection for supported AWS resources.
- AWS WAF rules can allow, block, or count web requests based on conditions.
- AWS Firewall Manager can centrally manage supported protections across accounts.
Best-known use cases
- Protect an internet-facing application from DDoS attacks.
- Block application requests that match malicious web patterns.
What candidates often confuse it with
- Shield mitigates DDoS attacks; WAF filters HTTP(S) requests.
- Security groups and network ACLs control network traffic at VPC resource and subnet boundaries.
Key Cloud Practitioner takeaway
DDoS protection points to Shield; web-request filtering points to WAF.
Related services
- Amazon VPC
- Amazon GuardDuty
Relevant exam tasks
- D2.2
- D2.4