CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS WAF, Shield & Firewall Manager: When to Use What for Web Application Security
Understand when to choose AWS WAF, Shield, and Firewall Manager for web application security and how to prepare for exam questions on these services.
Web application security is critical. AWS offers a suite of tools to protect against vulnerabilities and attacks. Knowing when to use AWS WAF, Shield, and Firewall Manager is essential for architects and exam candidates alike.
When to Choose What
AWS WAF
Use AWS WAF when you need to protect your web applications from common exploits like SQL injection and cross-site scripting (XSS). It offers customizable rules and real-time traffic monitoring, which is vital for applications that require specific security measures tailored to their unique threats.
AWS Shield
Opt for AWS Shield when deploying applications that require DDoS protection, especially in high-traffic scenarios. Shield Standard is free and automatically protects against common DDoS attacks. For advanced protection, including cost protection during attacks, choose AWS Shield Advanced.
AWS Firewall Manager
Use AWS Firewall Manager when managing multiple AWS accounts and needing to enforce consistent security policies across those accounts. It simplifies the management of firewall rules and helps maintain a strong security posture across your organization.
| Service | Purpose | Key Features | Cost Model |
|---|---|---|---|
| AWS WAF | Protect web applications from exploits | Customizable rules, real-time monitoring | Based on rules and requests |
| AWS Shield Standard | Basic DDoS protection | Automatic protection against common attacks | No additional cost |
| AWS Shield Advanced | Advanced DDoS protection | Cost protection, advanced threat detection | Monthly fee |
| AWS Firewall Manager | Centralized security management across accounts | Policy enforcement across multiple accounts | Based on managed accounts |
How the Exam Tests This
The exam often includes questions aimed at assessing your understanding of when to use each service. Here are a few patterns:
Scenario-Based Questions: You might encounter scenarios where you must determine the best service for a specific need, such as protecting a web application from an SQL injection attack. The key is to identify that AWS WAF is the correct choice.
Cost Implications: Expect questions about cost models, especially the differences between AWS Shield Standard and Advanced. Knowing that Shield Standard is free while Advanced incurs a fee is crucial.
Management and Setup: Questions may cover the requirement of AWS Organizations for AWS Firewall Manager. Recognizing this prerequisite can help you avoid common pitfalls.
The Rule to Remember
Choose AWS WAF for customizable web protection, AWS Shield for DDoS defense, and AWS Firewall Manager for centralized rule management across accounts.
For further practice, Take the free SAA-C03 mock exam.