A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates…

This solution effectively addresses the SQL injection vulnerability within the strict time and effort constraints. By introducing an Application Load Balancer (ALB) with an AWS Web Application Firewall (WAF) web ACL, the company can filter malicious SQL injection traffic before it reaches the vulnerable EC2 instances. The AWS WAF managed rule set for SQL injection (AWSManagedRulesSQLiRuleSet) provides immediate, pre-configured protection with minimal effort. The implementation plan, which involves setting up the new infrastructure in parallel and then cutting over via a DNS change in Route 53, ensures that normal operations are maintained without downtime. Finally, updating the EC2 security groups to only accept traffic from the ALB is a critical security best practice.

B: This option is flawed because it specifies using only one EC2 instance as an origin for CloudFront, which would remove the high availability and load balancing provided by the original two-instance setup, violating the "maintain normal operations" requirement.

C: Patching the legacy source code is a complex and time-consuming development task. It would almost certainly exceed the 24-hour deadline and contradicts the "least amount of effort" requirement, especially for software that no longer receives official updates.

D: This option is technically incorrect. AWS WAF cannot be directly attached to EC2 instances; it must be associated with an Application Load Balancer, Amazon CloudFront, Amazon API Gateway, or AWS AppSync. The security group change described is also irrelevant to preventing SQL injection.

1. AWS Documentation - AWS WAF: "You can deploy AWS WAF on Amazon CloudFront, Application Load Balancer, Amazon API Gateway, and AWS AppSync." This confirms that WAF can be applied to an ALB (Option A) but not directly to an EC2 instance (disproving Option D).

Source: AWS WAF Developer Guide, "How AWS WAF works", Section: "AWS WAF features".

2. AWS Documentation - AWS WAF SQL injection attack rule statement: "Use a SQL injection attack rule statement to inspect for malicious SQL code in the request body, query string, or URI path." This supports using WAF as the specific tool to mitigate the identified threat.

Source: AWS WAF Developer Guide, "Rule statement types", Section: "SQL injection attack rule statement".

3. AWS Documentation - Elastic Load Balancing: "An Application Load Balancer functions at the application layer... After the load balancer receives a request, it evaluates the listener rules in priority order to determine which rule to apply, and then selects a target from the target group for the rule action." This describes the core functionality used in Option A to route traffic to the EC2 instances.

Source: Application Load Balancer User Guide, "What is an Application Load Balancer?".

4. AWS Well-Architected Framework - Security Pillar: "We recommend that you use a multi-layered approach (defense in depth)... For example, you can use AWS WAF on Amazon CloudFront and Application Load Balancers (ALB) to help protect against application layer attacks like the OWASP Top 10." This endorses the architectural pattern in Option A as a security best practice.

Source: AWS Well-Architected Framework, Security Pillar, Whitepaper (aws-well-architected-framework.pdf), Page 31, Section: "SEC 5: How do you protect your networks?".