A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send…

The most effective solution is to use an AWS WAF rate-based rule. This rule type is specifically designed to count requests from individual source IP addresses over a rolling five-minute period. By creating a web ACL with a rate-based rule, setting the threshold to 10,000, and associating it with the CloudFront distribution, you can automatically track and act on excessive requests. AWS WAF natively integrates with Amazon CloudWatch, publishing metrics for rule actions. A CloudWatch alarm can be configured to monitor the metric for this rule and, upon being triggered, send a notification to the designated Amazon SNS topic. This approach is direct, managed, and scalable.

A. CloudFront standard logs are not processed in real-time, and metric filters are not designed for aggregating counts per unique IP address efficiently.

B. VPC Flow Logs capture network-level traffic and would see CloudFront's IP, not the end-user's IP, making it unsuitable for this application-level requirement.

C. An ASN match rule blocks or allows traffic based on the Autonomous System Number of the source, not the request rate from an individual IP address.

1. AWS WAF Developer Guide, "Rate-based rule statement": This section states, "A rate-based rule tracks the rate of requests for each originating IP address... AWS WAF counts the requests from any single IP address in a trailing, continuously updated, 5-minute period." This directly confirms the mechanism for counting requests per IP over the required time frame.

2. AWS WAF Developer Guide, "Monitoring with Amazon CloudWatch": This page details the integration, explaining, "You can monitor your web ACLs and rules using CloudWatch, which collects raw data from AWS WAF and processes it into readable, near real-time metrics... You can set alarms that watch for certain thresholds". This supports using CloudWatch alarms on WAF metrics.

3. Amazon CloudWatch User Guide, "Using Amazon CloudWatch alarms": This guide describes how to create alarms and configure actions. The section on "Alarm actions" explicitly lists "Notify an Amazon SNS topic" as a possible action when an alarm changes state.

4. AWS WAF Developer Guide, "Associating or disassociating a web ACL with an AWS resource": This document confirms that a web ACL can be associated with an Amazon CloudFront distribution, which is a prerequisite for the solution.