Network Security Implementation: WAF, Network Firewall, and Shield

Let us break down network security on AWS from the ground up. Imagine your cloud infrastructure is a private estate with several buildings. You need to control who comes in the front gate, what they do once inside the main grounds, and protect against a massive storm that could flatten everything.

The first layer is the front gate guard: AWS WAF (Web Application Firewall). WAF protects your web applications (like a website or an API, which is a way for programs to talk to each other) from common attacks that exploit the application itself. For example, a common attack is an SQL injection, where an attacker types malicious database commands into a form on your website. WAF inspects the web request (the HTTP or HTTPS data) and blocks it if it matches a known malicious pattern. You configure WAF with rules—for instance, block all traffic from a specific country, or block requests that contain SQL commands. WAF operates at Layer 7 of the OSI model (the application layer), which is the layer that humans and applications interact with directly. It is incredibly fast and stateless in the sense that each request is inspected individually, but clever attackers can still bypass simple WAF rules by crafting requests that look normal but are dangerous.

The second layer is the estate's internal security patrol: AWS Network Firewall. This is not just for web traffic; it protects your entire Virtual Private Cloud (VPC), which is your private, isolated section of the AWS cloud. Traffic inside your VPC can be between different servers (EC2 instances), between a server and a database, or going out to the internet. Network Firewall inspects all this traffic at Layer 3 (network layer, IP addresses) and Layer 4 (transport layer, ports like TCP/UDP). It can do stateful inspection, meaning it remembers the state of a connection—so if a server sends a packet asking for data, the firewall knows that the returning packet is part of the same legitimate conversation and allows it through. It can also block traffic based on domain names, block malicious IP addresses from threat intelligence feeds (lists of known bad actors), and perform intrusion prevention (deep packet inspection to find malware in the traffic itself). Think of it as the guard who walks through the estate, not just checking IDs at the gate, but also looking at what people are carrying and where they are going.

The third layer is the storm shelter: AWS Shield. Shield is a managed DDoS (Distributed Denial of Service) protection service. A DDoS attack is when an attacker floods your network or application with so much garbage traffic that it becomes overwhelmed and cannot serve legitimate users—like a mob of hundreds of people rushing the gate all at once. Shield Standard is included automatically for every AWS customer at no extra cost; it protects against the most common, low-level DDoS attacks (like SYN floods or UDP reflection attacks). Shield Advanced is a paid service that gives you almost unlimited capacity to absorb the largest attacks, plus access to the AWS DDoS Response Team (DRT) who will help you mitigate the attack in real-time. Shield sits at the very edge of the AWS network, before traffic even reaches your VPC or your WAF. Its job is to absorb and filter out the volumetric garbage so that only clean traffic reaches your other security layers.

Why do you need all three? Because each layer covers a different attack surface. WAF only handles web application attacks (Layer 7). Network Firewall can handle non-web traffic (like SSH or database connections) and inspect deeper into packets. Shield is your last line of defence against the kind of attack that can knock your entire internet connection offline. A skilled attacker might try all three: a DDoS to distract you, then a SQL injection attack at the application layer. If you only have Shield, the SQL injection might get through. If you only have WAF, the DDoS might take you down before WAF even sees the traffic. Layering them is the essence of a 'defence in depth' strategy.

Here is how they interact in a typical AWS architecture:

This layered approach ensures that even if one service is bypassed or overwhelmed, another is there to catch the threat. On the ANS-C01 exam, you must understand the specific responsibilities of each service and when to use them together versus standalone.

You are the cloud security engineer for a fast-growing e-commerce startup called 'ShopSwift', which sells handmade furniture online. The company hosts its main website on AWS using EC2 instances behind an Application Load Balancer, and its customer database is on Amazon RDS (Relational Database Service). The website is global, handling thousands of transactions per day.

One Monday morning, your boss calls you in a panic: the company's main competitor just suffered a massive data breach, and the CEO is terrified that the same will happen to ShopSwift. You have been tasked with implementing robust network security over the next two weeks.

Here is exactly how you, as an IT professional, would use WAF, Network Firewall, and Shield:

First, you enable AWS Shield Advanced immediately. You know that a DDoS attack is the easiest way to shut down an e-commerce site, and even a minute of downtime during a sale could cost thousands. You subscribe to Shield Advanced for the entire AWS Organisation, which protects the ALB, CloudFront (which you also enable for static assets), and your Elastic IPs. You also activate the cost protection feature, so if a DDoS attack causes a spike in your AWS bill, AWS will credit you back.

Second, you deploy AWS WAF on your Application Load Balancer. You are not using CloudFront for the main API yet, so the ALB is the front door. You create a set of rules:

Third, you implement AWS Network Firewall inside your VPC. You place it in a dedicated subnet (the firewall subnet) and route all traffic between your public subnets (where the ALB and web servers live) and your private subnets (where the database lives) through it. This gives you east-west traffic inspection (traffic between servers inside the VPC). You configure stateful rules:

Finally, you test everything. You use the AWS WAF testing tools to simulate attacks. You check CloudWatch metrics for the Network Firewall to see what traffic it is dropping. You run a penetration test (with AWS approval) to confirm that a simulated DDoS is absorbed by Shield Advanced without your website going down.

The result: ShopSwift is now protected against the three biggest threats—volumetric DDoS (Shield), application-layer attacks (WAF), and deep packet-level intrusions (Network Firewall). Your boss sleeps better, and you are ready for the advanced networking concepts on the ANS-C01 exam.