Skip to main content

Infrastructure protection

Protect the edge from volumetric and application-layer attacks, keep hosts patched by rebuild rather than by hand, and monitor the network for what gets through.

DDoS protection​

LayerServiceWhat it does
3/4AWS Shield StandardAutomatic protection against common network and transport attacks — SYN floods, DNS floods, UDP reflection
3/4AWS Shield Standard + CloudFrontEdge distribution absorbs volume before it reaches the origin
7AWS WAFRate limiting and pattern-based blocking at the application layer
AllShield AdvancedDDoS Response Team, enhanced reporting, cost protection during an attack

Shield Advanced is appropriate where the workload has a high-value public surface and the cost of absorbing an attack is material. Shield Standard is automatic and covers the common cases.

Web application firewall​

A WAF Web ACL is attached to every public entry point: CloudFront, ALB, API Gateway, AppSync.

Rule order​

1. Allow-list known integration IP ranges (where required)
2. Block IPs on the threat list
3. AWS Managed Rules — baseline
4. AWS Managed Rules — known bad inputs
5. AWS Managed Rules — SQL injection
6. Rate-based rule per IP
7. Custom rules for application-specific abuse
8. Default action: allow (with logging)

Order matters. A rate limit placed after a block rule never sees the blocked traffic; an allow-list placed after a block rule can be unreachable.

Managed rule groups​

GroupProtects against
AWSManagedRulesCommonRuleSetOWASP Top 10 baseline
AWSManagedRulesKnownBadInputsRuleSetExploit payload patterns
AWSManagedRulesSQLiRuleSetSQL injection
AWSManagedRulesLinuxRuleSet / WindowsRuleSetOS-specific exploits
AWSManagedRulesBotControlRuleSetAutomated abuse

Managed rules are not a complete configuration. They are the baseline; custom rules address the application's own abuse patterns.

Rate limiting​

{
  "Name": "RateLimitPerIp",
  "Priority": 10,
  "Action": { "Block": {} },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 2000,
      "AggregateKeyType": "IP"
    }
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLimitPerIp"
  }
}

Set the limit above the busiest legitimate client, not at a round number. A limit that blocks real users is an outage with a security label.

Logging​

WAF logs go to CloudWatch Logs, S3 or Firehose. Logs are essential: without them a blocked request cannot be distinguished from a request that never arrived.

Patch management​

WorkloadMechanismCadence
EC2Rebuild AMI, instance refreshMonthly; immediately for critical
ContainersRebuild base image, redeployWeekly; immediately for critical
LambdaRuntime and dependency upgradePer support window
Managed servicesAWS-managedMonitored via AWS Health
Instances managed by SSMPatch baseline and maintenance windowMonthly

Patching by replacement is preferred: a rebuilt instance is known-good, whereas a patched instance has a history. Where in-place patching is unavoidable — long-lived stateful hosts — Systems Manager Patch Manager applies baselines on a schedule and reports compliance.

Patch compliance​

  • Patch baseline per environment and OS family.
  • Maintenance window with a defined concurrency.
  • Compliance report reviewed weekly.
  • Non-compliant instances above the threshold raise an alarm.
  • Emergency patch path: rebuild, publish, deploy through the normal pipeline.

Host hardening​

ControlImplementation
Minimal imageNo compilers, package managers or debug tools in the runtime image
Non-root processApplication runs as an unprivileged user
Read-only filesystemWhere the application does not need to write locally
IMDSv2 requiredEnforced by SCP
No SSH from the internetSession Manager for administrative access
Host firewallSecurity groups as the primary control; local firewall as defence in depth
Audit loggingCloudWatch agent + OS audit rules, shipped centrally
Disk encryptionEBS encryption by default

Network inspection​

ControlWherePurpose
Security groupsEvery ENIInstance-level allow rules
NACLsSubnetSubnet-level allow/deny, including explicit deny
AWS Network FirewallVPC perimeterStateful inspection, domain filtering, IDS/IPS
VPC Flow LogsEvery VPCVisibility into accepted and rejected traffic
Route 53 Resolver DNS FirewallDNS layerBlock resolution of known-malicious domains
Firewall ManagerOrganisationApply policy centrally, including accounts created later

Monitoring​

SignalAlarm
WAF blocked requests spikeInvestigate source and pattern
Shield detected attackNotify security; check origin health
Unusual egress volumePossible exfiltration
Rejected flows from internal hostsPossible lateral movement
Patch compliance below thresholdRemediate
Public security group openedImmediate review