WAF and edge protection

advanced

Scenario & brief

The application takes unfiltered traffic straight from the internet — no WAF to block common exploits and bots — and the tiers behind the ALB are loosely exposed.

By the end, nothing should reach the ALB except through a WAF, and the app and database tiers should sit somewhere the internet can't reach directly — with the database encrypted at rest and private-subnet egress still working.

3,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $200/mo

WAF

Security

Enable WAF

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity25

Requirements met14

Requirements

WAF is enabled at the edge — disabled (need enabled)
Load balancer accepts only from the WAF — from internet (need only from waf)
App servers in a private subnet — public subnet (need private subnet)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Database encrypted at rest — plaintext (need encrypted at rest)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

WAF is enabled at the edge: Add / turn this protection on.
Load balancer accepts only from the WAF: Restrict the security group to accept traffic only from waf.
App servers in a private subnet: Move it to the private subnet.
Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Database encrypted at rest: Enable encryption at rest.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.