A public web application needs layered protection.
The team must distinguish HTTP request conditions from connections to an instance.
Which mapping is correct?
AWS WAF controls HTTP or HTTPS requests, while security groups control network connections allowed to resources such as EC2 instances.
Detailed explanation
Those are not the primary roles of WAF or security groups.
Those are not the primary roles of WAF or security groups.
These are network and web-protection controls, not IAM password settings.
These are network and web-protection controls, not IAM password settings.
CloudTrail records API activity and services such as Artifact provide compliance documents.
CloudTrail records API activity and services such as Artifact provide compliance documents.
WAF inspects request content and security groups control allowed network connections at the resource layer.
WAF inspects request content and security groups control allowed network connections at the resource layer.
Check official documentation
Compare the following points with the official documentation.
AWS WAF Developer GuideのWhat is AWS WAF?とAmazon EC2 security groupsの説明を確認する。
What to confirm
Webリクエストの検査はWAF、インスタンスへの許可ポート・送信元制御はセキュリティグループで設計する。
Key points
- AWS WAF
- Security group
- Web and network layers
Notes
- Environment: AWS公式WAF・EC2ドキュメントの確認
- Confirm current security service capabilities and support-plan conditions in the official AWS documentation.
Foundation review
Layered protection
WAF and security groups can address different points in the path to a workload.
Different evidence
API activity and compliance reports come from CloudTrail and Artifact rather than these traffic controls.