A public web API needs protection from SQL injection and common web attacks, as well as stronger DDoS protection.
Choose services by role.
Choose TWO appropriate mappings.
AWS WAF inspects HTTP requests for web attacks, while AWS Shield provides DDoS protection; they address different threat layers.
Detailed explanation
Shield provides DDoS protection for AWS resources.
Shield provides DDoS protection for AWS resources.
IAM authorizes AWS API actions; it does not inspect web request bodies.
IAM authorizes AWS API actions; it does not inspect web request bodies.
WAF applies rules to web requests and can block SQL injection and other application attacks.
WAF applies rules to web requests and can block SQL injection and other application attacks.
S3 Lifecycle manages object transitions and deletion, not network attacks.
S3 Lifecycle manages object transitions and deletion, not network attacks.
Check official documentation
Compare the following points with the official documentation.
AWS WAFとAWS Shieldの公式概要を確認する。
What to confirm
Web攻撃とDDoSの対策をWAFとShieldへ対応付けられる。
Key points
- AWS WAF
- AWS Shield
- SQL injection
- DDoS
Notes
- Environment: AWS公式WAF・Shieldドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Threat layer
WAF addresses application request patterns, while Shield addresses distributed denial-of-service traffic.
Layered defense
Using controls for their intended layer avoids treating an identity or storage feature as a network defense.