Chapter 62: AWS Network Protection
AWS Network Protection
This is not one single button or service. It is a complete layered defense system made of several AWS services that work together to keep bad traffic away from your application, your database, your APIs, and your wallet.
If you ignore network protection, one bad day can bring:
- A DDoS attack that makes your website unreachable for hours
- A bill shock of ₹50,000+ from thousands of fake requests
- SQL injection / XSS that steals customer data
- Bots scraping your pricing / menu → competitors undercutting you
- Reputation damage (“site was down during IPL finals”)
So let’s do this properly — like I’m your favorite teacher who wants you to never be the person reading that headline.
1. The Four Layers of AWS Network Protection (2026 Reality)
Think of network protection as four concentric rings around your application:
| Ring / Layer | Main Services Involved | What it stops / protects against | Typical Hyderabad startup example (2026) |
|---|---|---|---|
| Layer 1 – Global Edge Protection | AWS Shield Standard (free) + AWS Shield Advanced (paid) + CloudFront / Global Accelerator | Volumetric DDoS, SYN floods, UDP floods, reflection attacks | Shield Standard protects public ALB during IPL traffic spike |
| Layer 2 – Web Application Firewall | AWS WAF (on CloudFront, ALB, API Gateway) | SQL injection, XSS, HTTP flood, bots, geo-blocking, rate limiting | Block login brute-force & known bad IPs on food delivery app |
| Layer 3 – Network Firewall | AWS Network Firewall | Deep packet inspection, stateful rules, intrusion prevention | Fintech blocks known C2 domains & malware patterns |
| Layer 4 – VPC / Resource-Level Controls | Security Groups, NACLs, VPC Flow Logs | Port scanning, unauthorized internal access | RDS only reachable from ECS tasks (no public port 5432) |
2. Layer-by-Layer Deep Dive (With Real Examples)
Layer 1 — AWS Shield (DDoS Protection)
AWS Shield Standard — free on all AWS customers
- Protects against common Layer 3/4 DDoS (SYN flood, UDP reflection, DNS amplification)
- Automatically enabled on CloudFront, ALB, Global Accelerator, Elastic IP
- Mitigates ~90 % of attacks without any configuration
AWS Shield Advanced — paid (~₹3,000–10,000/month depending on size)
- 24×7 DDoS Response Team (DRT)
- Cost protection (no spike in bill during attack)
- Advanced detection (Layer 7 attacks)
- WAF integration + dedicated mitigation capacity
Hyderabad example – IPL final night Your food delivery app gets 10× normal traffic + bot DDoS trying to slow you down. → Shield Standard automatically absorbs volumetric attacks → If attack is sophisticated → Shield Advanced engages DRT → keeps site up → You don’t pay extra for the massive traffic
Layer 2 — AWS WAF (Web Application Firewall)
WAF sits in front of CloudFront, ALB, API Gateway and inspects every HTTP/S request.
You create rules that block:
- SQL injection / XSS / command injection
- Known bad bots & scanners
- Rate-based rules (block IP after 2,000 requests in 5 min)
- Geo-blocking (block traffic from certain countries)
- Size constraints, string match, regex match, IP sets
Managed rules — AWS writes & updates them for you:
- AWS Managed Rules (free) — OWASP Top 10, Core rule set
- Marketplace rules — third-party vendors (e.g., F5, Imperva)
Hyderabad example – food delivery login page
- Bots try 10,000 login attempts/min → WAF rate-based rule blocks IP after 100 attempts in 5 min
- SQL injection attempts on /login endpoint → AWSManagedRulesSQLiRuleSet blocks them
- Monthly WAF cost: ~₹1,000–5,000 (very cheap insurance)
Layer 3 — AWS Network Firewall (Deep Inspection)
This is stateful firewall + intrusion prevention at the VPC level.
You define rules like:
- Block known malicious domains/IPs
- Block traffic with certain signatures (malware C2, exploit attempts)
- Allow only specific ports/protocols between subnets
Hyderabad example – fintech payment service
- Network Firewall rule: block outbound traffic to known crypto-mining pools
- Alert on any attempt to exfiltrate data to suspicious IPs
- Cost: ~₹2,000–8,000/month (depends on traffic inspected)
Layer 4 — VPC-Level Controls (Security Groups + NACLs)
- Security Groups = stateful firewalls attached to resources (EC2, ECS tasks, RDS, Lambda) → Allow inbound/outbound rules (e.g., allow 443 from anywhere, allow 3306 only from ECS SG)
- NACLs = stateless firewalls at subnet level (rarely needed if Security Groups are tight)
Hyderabad example – food delivery database
- RDS Aurora in private subnet
- Security Group: allow inbound 5432 only from ECS task Security Group
- Result: impossible to connect to database from internet or unauthorized EC2
5. Quick Hands-On – Feel Basic Protection
- Create ALB → enable AWS Shield Standard (automatic)
- Attach AWS WAF web ACL → add managed rule group “AWSManagedRulesCommonRuleSet”
- Add rate-based rule → block IP after 2,000 requests in 5 min
- Create Security Group for RDS → allow 5432 only from ALB SG
- Enable GuardDuty → wait 24 h → see sample findings
Cost? Usually ₹0–500 for testing (Shield Standard & basic WAF free tier).
Summary Table – AWS Network Protection Cheat Sheet (2026 – India Focus)
| Layer / Threat | Primary Protection Service(s) | Golden Rule / Best Practice |
|---|---|---|
| Volumetric DDoS (Layer 3/4) | AWS Shield Standard (free) | Always on for public endpoints — consider Advanced for large apps |
| Web attacks (SQLi, XSS, bots) | AWS WAF on CloudFront/ALB/API GW | Use AWS Managed Rules + rate-limiting + geo-block if needed |
| Deep packet inspection / malware | AWS Network Firewall | Use for outbound C2 blocking, known bad domains |
| Resource-level access | Security Groups, NACLs | Least privilege — allow only necessary ports & sources |
| Logging & threat detection | GuardDuty, Security Hub | Enable both — central visibility & alerts |
Teacher’s final note (real talk – Hyderabad 2026):
Network protection is layered defense — no single service saves you; you need several working together.
Most production incidents in India come from:
- Missing WAF on public ALB/API Gateway
- Security Groups allowing 0.0.0.0/0 on database ports
- No GuardDuty → blind to compromised credentials
- No rate-limiting → bots scrape pricing or brute-force login
Do these four things and you’re already safer than 80 % of apps:
- Shield Standard — always on
- WAF on every public endpoint
- Security Groups — deny by default, allow only what is needed
- GuardDuty + Security Hub — enable & monitor alerts
Got it? This is the “keep the bad traffic out” lesson.
Next?
- Step-by-step: Set up WAF on ALB with managed rules + rate-limiting?
- Deep dive: Security Groups vs NACLs vs AWS Network Firewall?
- Or how GuardDuty finds compromised keys in real time?
Tell me — next whiteboard ready! 🚀🛡️
