CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Protecting Your Web Application at the Edge
Learn how to choose the right AWS service to protect your web application from common exploits like SQL injection and cross-site scripting.
A common challenge for candidates is identifying the best service to secure applications against web exploits. Many services exist, but only one is specifically designed for this task.
The question
A web application must be protected against common exploits such as SQL injection and cross-site scripting at the edge. Which service should be attached to the CloudFront distribution?
- A: AWS WAF
- B: Security Groups
- C: Amazon Inspector
- D: AWS Config
Think before you scroll
Consider the specific requirements for protecting a web application. Look for a service that directly addresses web traffic filtering, especially for common vulnerabilities.
The answer
The correct option is A: AWS WAF. AWS WAF is explicitly designed to filter out malicious web requests, including SQL injection and cross-site scripting. It integrates seamlessly with CloudFront, providing edge protection for your applications.
Why the other options lose
- B: Security Groups: Security Groups control access at the instance level, mainly for inbound and outbound traffic. They do not specifically filter web application attacks like SQL injection or XSS, making them unsuitable for edge protection.
- C: Amazon Inspector: Amazon Inspector is a security assessment service that helps identify vulnerabilities within your applications. However, it does not actively filter incoming web requests, leaving your application exposed to exploits.
- D: AWS Config: AWS Config monitors and records your AWS resource configurations. While important for compliance and auditing, it does not provide real-time protection against web exploits like SQL injection or XSS.
The concept behind it
Understanding the role of AWS WAF is crucial. It acts as a firewall specifically for web applications, analyzing incoming traffic and allowing you to define rules for what is considered malicious. This knowledge is transferable to any scenario where edge protection is necessary.
Exam trap to remember
Remember: AWS WAF is your go-to for web application protection at the edge. It filters malicious requests effectively, while other services serve different security purposes.