A web API is exposed behind an ALB.
Inspect common SQL injection patterns before requests reach the application.
Which architecture is most appropriate?
Associate AWS WAF managed rules with the ALB to inspect and block SQL injection patterns at the web entry point.
Detailed explanation
S3 Lifecycle manages objects and does not inspect web requests.
S3 Lifecycle manages objects and does not inspect web requests.
Relying on one layer misses a useful defense-in-depth control.
Relying on one layer misses a useful defense-in-depth control.
WAF inspects HTTP requests and can block common SQL injection patterns.
WAF inspects HTTP requests and can block common SQL injection patterns.
Security groups control network addresses and ports, not HTTP request bodies.
Security groups control network addresses and ports, not HTTP request bodies.
Check official documentation
Compare the following points with the official documentation.
AWS WAF managed rulesとALB関連付けの公式説明を確認する。
What to confirm
ネットワーク制御とHTTPリクエスト検査の役割を分けられる。
Key points
- AWS WAF
- SQL injection
- ALB
Notes
- Environment: AWS公式WAF・ELBドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Defense in depth
A web firewall complements, rather than replaces, secure application validation.
Layer distinction
Security groups filter network traffic; WAF evaluates HTTP request content.