A retail company has recently migrated its website to AWS. The company wants to ensure that it is protected from SQL injection attacks. The website…

AWS WAF (Web Application Firewall) is a service designed to protect web applications from common web exploits. It operates at the application layer (Layer 7) and can inspect the contents of HTTP/S requests. AWS WAF allows you to configure rules to allow, block, or monitor web requests based on conditions you define. This includes creating custom rules or using managed rule sets specifically designed to identify and block patterns associated with attacks like SQL injection and cross-site scripting (XSS). It integrates directly with services like Application Load Balancer, Amazon CloudFront, and Amazon API Gateway.

A. Security groups: Security groups act as a stateful firewall at the instance level, controlling traffic based on protocol and port numbers (Layer 4), not the content of application traffic.

C. Network ACLs: Network ACLs are stateless firewalls at the subnet level, filtering traffic based on IP addresses and ports (Layers 3 and 4). They cannot inspect application-layer payloads.

D. AWS Shield: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. While it works with AWS WAF for comprehensive protection, its primary function is mitigating DDoS attacks, not blocking specific web exploits like SQL injection.

1. AWS WAF Developer Guide: "AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to your protected AWS resources... you can protect your resources from common attack patterns

such as SQL injection and cross-site scripting (XSS)." (Source: AWS WAF Developer Guide

"What is AWS WAF?"

Introduction section).

2. AWS WAF Developer Guide: "You can use AWS WAF to create custom rules that block common attack patterns

such as SQL injection or cross-site scripting (XSS)." (Source: AWS WAF Developer Guide

"How AWS WAF works"

Overview section).

3. Amazon VPC User Guide: "A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets." It specifies rules are based on protocol

port range

and source/destination IP address. (Source: Amazon VPC User Guide

"Control traffic to subnets using network ACLs"

Introduction).

4. Amazon EC2 User Guide for Linux Instances: "A security group acts as a virtual firewall for your instance to control inbound and outbound traffic... You can add rules to each security group that allow traffic to or from its associated instances." The rules are defined by protocol

port

and source/destination. (Source: Amazon EC2 User Guide for Linux Instances

"Amazon EC2 security groups for Linux instances"

Security group basics section).

5. AWS Shield Developer Guide: "AWS Shield is a managed distributed denial of service (DDoS) protection service... For protection against application layer (layer 7) DDoS attacks

you can use AWS WAF to create custom rules." (Source: AWS Shield Developer Guide

"What is AWS Shield?"

Introduction section).