AWS › AWS WAF & Shield
How should an organization design a layered defense in depth strategy combining WAF, Shield, security groups, and network ACLs to protect a public facing application?
AdvancedAnswer
A layered defense typically places Shield Standard or Advanced at the outermost layer for automatic DDoS protection, WAF next to filter application layer threats like SQL injection and bot traffic at services like CloudFront or an Application Load Balancer, security groups to enforce which specific ports and sources can reach individual EC2 instances or containers, and network ACLs as an additional stateless layer of subnet level filtering, together creating multiple independent layers of defense so that a weakness or misconfiguration in any single layer does not immediately compromise the entire application.
aws ec2 create-network-acl-entry --network-acl-id acl-12345 --rule-number 100 --protocol tcp --port-range From=443,To=443 --cidr-block 0.0.0.0/0 --rule-action allowReal-world example A company protecting a critical public facing payment application layers Shield Advanced for DDoS protection, WAF managed rules for application layer threats, restrictive security groups limiting instance access, and network ACLs for additional subnet level filtering, ensuring no single point of failure in their overall security posture.