AWS WAF is your shield against SQL Injection, Cross-Site Scripting (XSS), and automated bots.
You don't have to write your own security rules. AWS provides **Managed Rulesets** that automatically block known bad IP addresses and common OWASP Top 10 exploits. **Architect Tip:** Always enable the 'Core Rule Set' (CRS) on your production Load Balancers.
If your app only serves the US, you can use WAF to block all traffic from other countries. You can also set a rate limit (e.g., '100 requests per 5 minutes per IP') to prevent brute-force attacks on your login endpoints.
Q: "Where should I attach WAF?"
Architect Answer: "You can attach WAF to an **ALB**, **API Gateway**, or **CloudFront**. If you are using CloudFront, attach the WAF there—this allows you to block malicious traffic at the 'Edge' before it ever reaches your infrastructure, saving you bandwidth and compute costs."