Web Application Firewall

AWS WAF is your shield against SQL Injection, Cross-Site Scripting (XSS), and automated bots.

1. Managed Rules

You don't have to write your own security rules. AWS provides **Managed Rulesets** that automatically block known bad IP addresses and common OWASP Top 10 exploits. **Architect Tip:** Always enable the 'Core Rule Set' (CRS) on your production Load Balancers.

2. Geo-Blocking and Rate Limiting

If your app only serves the US, you can use WAF to block all traffic from other countries. You can also set a rate limit (e.g., '100 requests per 5 minutes per IP') to prevent brute-force attacks on your login endpoints.

3. Architect Insight

Q: "Where should I attach WAF?"

Architect Answer: "You can attach WAF to an **ALB**, **API Gateway**, or **CloudFront**. If you are using CloudFront, attach the WAF there—this allows you to block malicious traffic at the 'Edge' before it ever reaches your infrastructure, saving you bandwidth and compute costs."