Edge security, Shield, and DDoS protection. These are the walls and moat around your castle on the internet. For the SCS-C02 exam, you must understand how to defend a web application from being knocked offline by a massive flood of junk traffic, and how to use Amazon’s global infrastructure to absorb that flood before it reaches your servers.
Jump to a section
A simple way to picture Edge Security, Shield, and DDoS Protection
2,000 identical customer orders per second. That’s the rate at which your friend’s online bakery shop normally receives requests for its famous sourdough recipe cards. The shop is a single room with one counter and one cash register. One day, 200,000 orders arrive all at once. Your friend is thrilled. But each order is fake, designed to keep the cash register busy so real customers can’t pay. The shop is overwhelmed. The cash register crashes. The baker can’t fulfil any real orders for hours.
To stop this happening again, your friend installs a smart gate outside the shop’s front door. Every person who approaches is quickly checked. The gate recognises known loyal customers and lets them straight through. It spots suspicious patterns — 50 people wearing the same coat arriving in one car — and blocks them before they reach the door. It also notices if one person tries to push through the gate over and over in two seconds; it slows that person down. The baker’s real customers now get served faster because the gate absorbs the attack. The baker also buys a second, identical shop in a different town. If one shop is overwhelmed, the other can serve all customers instantly. That’s edge security with AWS Shield and DDoS protection: a smart gate that filters bad traffic at the edge of your network, backed by extra capacity that can absorb almost any flood.
Edge security is the practice of protecting your applications at the outermost boundary of your network, closest to your users and closest to attackers. Instead of letting all internet traffic hit your web servers directly (which would slow everything down and increase risk), you place security services at the network edge — often on Amazon CloudFront, the AWS content delivery network (CDN). A CDN is a system of servers distributed around the world that cache copies of your static content (images, scripts, videos) closer to users for faster loading. But it can also inspect and filter traffic before it reaches your origin (your main application server).
AWS Shield is a managed service that protects against distributed denial-of-service (DDoS) attacks. A DDoS attack is when an attacker uses thousands of compromised computers (a botnet) to send so much junk traffic to your website that your servers cannot respond to legitimate users. There are two tiers. AWS Shield Standard is free and automatically protects all AWS customers against common, small attacks like SYN floods or UDP reflection attacks. AWS Shield Advanced costs a monthly fee but provides additional detection, near-real-time visibility, and financial protection against scaling costs caused by an attack. Shield Advanced also integrates with AWS WAF (Web Application Firewall), which inspects HTTP/HTTPS requests for bad patterns (SQL injection, cross-site scripting) and blocks them. CloudFront acts as the first line of defence: it sits between the user and your origin server. Because CloudFront has hundreds of locations worldwide (edge locations), it can absorb massive traffic spikes. A DDoS attack aimed at your domain hits CloudFront, not your actual server. CloudFront can drop malicious requests before they ever reach you. AWS WAF can be attached to CloudFront, to an Application Load Balancer (ALB) inside your virtual private cloud (VPC), or to Amazon API Gateway. WAF uses rules that inspect things like IP addresses, HTTP headers, URI paths, query strings, and request body size. You can also use rate-based rules: if a single IP sends more than 2,000 requests in five minutes, block it for a while. This throttles aggressive bots. AWS Shield Advanced adds DDoS-specific intelligence, including a web application firewall (WAF) that can automatically adapt to new attack patterns. It also provides access to the AWS DDoS Response Team (DRT) who can help you tune your protections during an active attack.
A related service is AWS Firewall Manager, which lets you centrally configure and manage firewall rules across multiple accounts and resources inside AWS Organizations. Instead of writing WAF rules for each load balancer individually, a security administrator can define a set of rules once and apply them across the entire organisation. This is especially important for large companies with hundreds of applications. AWS also offers Route 53 as a DNS (Domain Name System) service — the phonebook of the internet. Route 53 can also help mitigate DDoS attacks by distributing traffic across multiple endpoints and providing DNS-level filtering. If an attacker tries to overwhelm your DNS server, Route 53’s global infrastructure can absorb that too.
Finally, the highest level of protection involves architectural patterns like using multiple AWS Regions with an origin failover and using Elastic Load Balancing (ELB) to distribute traffic across multiple instances in multiple Availability Zones (isolated data centres within a region). If one availability zone is attacked, others still serve traffic. The SCS-C02 exam expects you to know when to use CloudFront + WAF, when to use Shield Advanced, and how all these services work together to create a layered defence (defence in depth).
Design the edge architecture
Decide that your web application will be served through Amazon CloudFront. You configure a CloudFront distribution that routes requests to your ALB (in a private subnet) or to an S3 bucket for static files. This step is the foundation of edge security because CloudFront absorbs traffic at hundreds of locations worldwide, preventing attacks from reaching your origin.
Attach an AWS WAF web ACL to CloudFront
You create a web ACL (Access Control List) and associate it with your CloudFront distribution. Inside the web ACL, you add rules: IP reputation lists, SQL injection detection, XSS detection, and a rate-based rule. This allows you to inspect every HTTP request before it travels further, dropping malicious ones immediately.
Enable AWS Shield Advanced on critical resources
You subscribe to Shield Advanced and enable it for your CloudFront distribution, your ALB, and your Route 53 hosted zone. This gives you enhanced DDoS metrics, 24/7 access to the AWS DDoS Response Team, and cost protection: if an attack causes your resources to scale aggressively, AWS covers the extra costs.
Test the configuration with simulated attacks
You use a tool like AWS Fault Injection Simulator or a third-party DDoS testing service to simulate a small-scale attack in a staging environment. You verify that the WAF rate-based rule triggers and blocks excessive requests. You test that CloudFront still serves cached content during the simulated flood.
Enable logging and monitoring for incident response
You turn on AWS WAF logs and send them to Amazon S3 and CloudWatch Logs. You also enable Shield Advanced event notifications via Amazon SNS. During an attack, you can review logs in real time to see which rules are triggering and whether legitimate traffic is being incorrectly blocked. This step ensures you can respond and tune rules during an active incident.
Document and automate the deployment with AWS Firewall Manager (if multi-account)
If your organisation uses multiple AWS accounts, you enable AWS Firewall Manager. You create a common set of WAF rules (including rate limiting and managed rule groups) and push them to every account in your organisation. This ensures consistent edge security across all applications and prevents individual teams from accidentally leaving a service unprotected.
A real-world scenario: You are the security engineer for an e-commerce site called 'ShopNow' that is launching a massive sale at 8 AM on Friday. The marketing team expects 50,000 legitimate users in the first hour. You anticipate that attackers might launch a DDoS attack to disrupt the sale and damage the brand. Here is exactly what you do step by step.
First, you configure Amazon CloudFront in front of your application. Instead of users hitting the webserver directly (shopnow.com), you point your DNS (Route 53) to the CloudFront distribution. CloudFront’s edge caches serve most of the static assets (product images, CSS files, JavaScript libraries) directly, which reduces the load on your origin. For dynamic content (user profiles, shopping cart), CloudFront forwards requests to your origin, which is an Application Load Balancer (ALB) running in three Availability Zones. You create an AWS WAF web ACL and attach it to the CloudFront distribution. Inside the ACL, you write the following rules:
- Block requests from IP addresses that are known to be part of attacker groups (using AWS Managed Rules for IP reputation lists). - Block requests missing a specific custom header that legitimate users always send (for example, 'X-ShopNow-App-Version: 3.2'). Attackers scanning the site will not include this header, so their requests will be dropped before they reach the ALB. - A rate-based rule: if any single IP sends more than 1,000 requests per five minutes, automatically block that IP for one hour. This stops aggressive scrapers and simple DDoS bots. - SQL injection rule and cross-site scripting (XSS) rule from the AWS Managed Rules group. You also subscribe to AWS Shield Advanced. This adds a dedicated team (DRT) you can contact if an attack slips through. Shield Advanced also gives you cost protection: if an attack causes your CloudFront or ALB to scale up massively, AWS will credit you for the additional resource usage, so you are not punished financially for being attacked. On the morning of the sale, an attacker launches a layer 7 (application layer) HTTP flood. The botnet sends 10 million requests per second to your homepage. CloudFront’s global edge network (over 450 locations) absorbs most of this traffic because it is spread across the internet. The WAF rate-based rule kicks in: the attack IPs quickly hit the rate limit and are blocked. Legitimate users, who normally send two requests per minute, are unaffected. The sale runs smoothly. After the event, you review the AWS WAF logs and Shield Advanced metrics. You see that over 99% of all incoming requests were dropped before they reached your origin. You save the DRT report as evidence for your compliance team. This exact scenario is what the SCS-C02 exam wants you to be able to design and explain.
The SCS-C02 exam tests 'Edge Security, Shield, and DDoS Protection' in several specific ways. Expect at least four to six questions on this domain. The exam loves layered defence: they will show you a scenario where an application is being DDoSed, and ask which combination of services would best protect it. The correct answer almost always includes CloudFront + WAF + Shield Advanced. Traps include: selecting only Shield Advanced without CloudFront (Shield Advanced alone cannot stop application-layer attacks as effectively without edge caching), or selecting only an AWS Network Firewall (which is for VPC boundary protection, not for global DDoS absorption).
Common question patterns:
You are given a scenario with a high-volume layer 7 attack (e.g., HTTP flood from thousands of IPs). Which solution reduces impact? Answer: CloudFront with AWS WAF rate-based rules and Shield Advanced.
A question about cost protection: Which service provides financial protection against scaling costs during a DDoS attack? Answer: AWS Shield Advanced.
A scenario about multiple accounts: You need to enforce a common set of WAF rules across all accounts in an organisation. Which service? Answer: AWS Firewall Manager.
A question about blocking a specific vulnerable URL pattern: You need to block requests containing '/wp-admin' to protect a WordPress site. Answer: AWS WAF with a string match condition on the URI path.
A tricky one about DNS-level DDoS: An attacker is flooding the DNS service itself. What protects AWS DNS? Answer: AWS Shield Standard (automatically protects Route 53).
Key definitions to memorise:
DDoS: Distributed Denial of Service — an attack that overwhelms a system with traffic from multiple sources.
Layer 3/4 attacks (SYN floods, UDP reflection) target the network and transport layers. Shield Standard mitigates these automatically.
Layer 7 attack (HTTP flood) targets the application layer. Mitigated by WAF and CloudFront.
Rate-based rule: a WAF rule that counts requests from a source and blocks when a threshold is exceeded.
AWS WAF web ACL: Access Control List — a set of rules that filter web requests.
Origin: the source server where your application actually runs (EC2 instance, ALB, S3 bucket, etc.).
Edge location: a data centre used by CloudFront to serve content closer to users.
Traps the exam sets:
They will offer a solution that uses only a Network ACL (subnet-level firewall) to stop a DDoS. But Network ACLs cannot inspect layer 7 content and cannot scale globally. This is a wrong answer.
They will offer a solution that uses an on-premises firewall appliance running on an EC2 instance. This cannot absorb a massive DDoS because the EC2 instance has limited bandwidth. Correct answer always involves a managed AWS service at the edge.
They will confuse students by mentioning 'AWS Shield' without specifying Standard or Advanced. Standard is free and automatic; Advanced is paid and includes DRT and cost protection. Question will specify 'a company that wants financial protection against DDoS scaling costs' — that forces Advanced.
They will test whether you know that WAF can be attached to CloudFront, ALB, API Gateway, and AppSync, but NOT to an EC2 instance directly.
They will test that you cannot use AWS WAF to block a layer 3/4 attack directly; that is Shield’s job.
Edge security means placing security controls at AWS CloudFront edge locations to filter traffic before it reaches your origin server.
AWS Shield Standard is free and automatically protects all AWS customers against common network-layer DDoS attacks like SYN floods.
AWS Shield Advanced costs a fee but provides DDoS cost protection, access to the DDoS Response Team, and enhanced detection for application-layer attacks.
AWS WAF inspects HTTP/HTTPS requests and can block SQL injection, XSS, and other attack patterns using rules you define or from AWS managed rule sets.
Rate-based rules in AWS WAF automatically block IP addresses that send an excessive number of requests within a time window, which stops many bot-driven DDoS attacks.
For multi-account environments, use AWS Firewall Manager to centrally apply common WAF rules across every account in your organisation.
A DDoS attack cannot be stopped by a single EC2 instance firewall — you must use AWS services at the global edge (CloudFront, Route 53, Shield) that have near-unlimited bandwidth.
The best protection for a web application against DDoS is a combination of CloudFront, AWS WAF, and Shield Advanced, deployed together as a layered defence.
These come up on the exam all the time. Here's how to tell them apart.
AWS WAF
Inspects application-layer (HTTP/HTTPS) content for patterns like SQL injection and XSS.
Requires you to write or select rules (managed rules available).
Costs based on web ACLs, rules, and requests inspected.
AWS Shield
Mitigates network-layer (Layer 3/4) DDoS attacks like SYN floods and UDP reflection.
Shield Standard works automatically without configuration; Shield Advanced requires subscription.
Shield Advanced provides cost protection and access to the DDoS Response Team (DRT).
Shield Standard
Free and automatically enabled for all AWS customers.
Protects against common DDoS attacks but provides no visibility or cost protection.
Does not include access to the AWS DDoS Response Team (DRT).
Shield Advanced
Paid service (monthly fee plus data transfer charges).
Provides financial protection against scaling costs caused by a DDoS attack.
Includes 24/7 access to the DDoS Response Team and near-real-time attack notifications.
CloudFront with WAF
Traffic is filtered at 450+ global edge locations before reaching the origin.
Can absorb massive DDoS attacks because edge locations have huge aggregate bandwidth.
Ideal for web applications with a mix of static and dynamic content.
Application Load Balancer (ALB) with WAF
Traffic is filtered after it enters the VPC, at the regional ALB level.
The ALB itself can be overwhelmed by a large DDoS because it has limited regional capacity.
Better for internal applications or APIs that should not be exposed to the global edge.
Mistake
AWS WAF alone can block any DDoS attack, including network-layer floods.
Correct
AWS WAF only inspects HTTP/HTTPS requests (layer 7). Network floods like SYN floods or UDP reflection attacks are blocked by AWS Shield Standard or Shield Advanced, not by WAF.
Beginners often see 'WAF' as a catch-all firewall. They don't distinguish between layers of the OSI model. The exam exploits this confusion.
Mistake
AWS Shield Advanced automatically protects all AWS services without any configuration.
Correct
Shield Advanced must be explicitly enabled and associated with specific resources like CloudFront, Elastic Load Balancers, or Route 53. It does not protect an EC2 instance unless it is behind an ALB.
The word 'Advanced' plus 'automatic' sounds powerful. Students assume it works everywhere without setup, but it is a resource-level subscription.
Mistake
Using a Network ACL (NACL) is a good way to stop a DDoS attack at the VPC level.
Correct
NACLs are stateless firewalls that filter traffic at the subnet level. They cannot handle the volume of a large DDoS and cannot inspect application-layer content. CloudFront at the edge is the correct approach.
Beginners learn about NACLs early and overestimate them. They think 'firewall = DDoS protection' without understanding scale.
Mistake
If I enable Shield Advanced, I no longer need to implement any other security measures.
Correct
Shield Advanced is one layer of defence. You still need CloudFront for edge caching and WAF for application-layer filtering. AWS promotes defence in depth, not a single silver bullet.
Marketing names like 'Advanced' imply completeness. Students fall into the trap of thinking one service does everything.
Mistake
DDoS protection is only about large traffic volumes; small attacks cannot cause damage.
Correct
Small, targeted attacks (e.g., a slowloris attack that opens many connections but sends data slowly) can still exhaust server resources. WAF rate-based rules and connection limits help here.
Popular media only covers massive attack numbers. Beginners do not consider low-and-slow attacks that are harder to detect.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
AWS WAF is a web application firewall that inspects HTTP/HTTPS requests for malicious content like SQL injection. AWS Shield protects against DDoS attacks by absorbing large volumes of junk traffic. You typically use both together: WAF for application-layer filtering and Shield for network-layer flood protection.
Yes, you can enable Shield Advanced on an Application Load Balancer or Route 53 directly. However, for best protection against application-layer DDoS attacks, you should place CloudFront in front of your origin because CloudFront’s global edge network can absorb attacks before they hit your ALB.
Yes. You pay for each web ACL you create, for each rule you add, and for the number of requests your web ACL inspects. There is no free tier for WAF, though Shield Standard is free. Check the AWS WAF pricing page for current rates.
A rate-based rule counts the number of requests from a single IP address within a five-minute window. If that IP exceeds a threshold you set (for example, 2,000 requests), the rule automatically blocks further requests from that IP for a duration you specify. This stops bots and simple DDoS attacks from overwhelming your application.
No. AWS WAF can only be attached to CloudFront, an Application Load Balancer, API Gateway, or AppSync. To use WAF, you must place your EC2 instance behind one of these services. A single EC2 instance with a public IP is not supported by WAF.
Shield Advanced significantly reduces risk but does not eliminate every attack vector. You still need to follow best practices: use CloudFront to cache content, attach WAF with rate-based rules, and design for horizontal scaling. No solution is 100% guaranteed against all DDoS attacks.
You've finished Edge Security, Shield, and DDoS Protection. Continue through the SCS-C02 study guide to build a complete picture of the exam.
Done with this chapter?