The conflation of AWS WAF and AWS Shield is a common point of confusion, even among seasoned practitioners. While both are security services operating at the application layer, their fundamental purposes, operational paradigms, and cost structures are distinct. A precise understanding is critical for effective architecture and cost management. At a high level, AWS WAF is a rule engine you configure, while AWS Shield is a managed mitigation service you subscribe to.
Let's break this down with specific, technical differentiators.
**AWS WAF (Web Application Firewall)**
* **Purpose:** A customizable rule engine for filtering and monitoring HTTP/HTTPS requests. You define the logic for what constitutes malicious traffic.
* **Control Model:** You are responsible for authoring, tuning, and maintaining the rule sets. This includes Managed Rule Groups from AWS or vendors, and your own custom rules.
* **Primary Use Cases:** Blocking common web exploits (SQLi, XSS), rate-limiting requests, geo-blocking, and implementing allow/deny lists based on IP, query strings, headers, or request body.
* **Example:** Creating a rule to block requests containing the SQL pattern `1=1` in the query string.
```yaml
# Example CloudFormation snippet for a custom SQLi rule
Rules:
- Name: BlockSQLInjection
Priority: 1
Statement:
SqliMatchStatement:
FieldToMatch:
QueryString: {}
TextTransformations:
- Priority: 0
Type: URL_DECODE
Action:
Block: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: BlockSQLInjection
```
* **Pricing:** You pay for rule groups deployed per web ACL, requests inspected per month, and additional fees for managed rule groups.
**AWS Shield**
* **Purpose:** A managed service providing protection against Distributed Denial of Service (DDoS) attacks.
* **Control Model:** AWS manages the mitigation mechanisms. Your interaction is primarily via enablement, configuration of protections for specific resources, and viewing metrics/alerts.
* **Tiers:**
* **Shield Standard:** Automatically enabled for all AWS customers at no cost. Provides basic, always-on protection against common network/transport layer (L3/L4) attacks.
* **Shield Advanced:** Paid service. Extends protection to application layer (L7) attacks, includes 24/7 DDoS response team (DRT) access, cost protection for scaling during attacks, and advanced visibility.
* **Primary Use Cases:** Mitigating volumetric, state-exhaustion, and application-layer DDoS attacks. Shield Advanced can also integrate with WAF to provide automatic rule creation during an attack.
* **Key Differentiator:** Shield's protections are *proactive* and *always-on* for the covered resources, whereas WAF is *reactive* based on your explicitly configured rules.
**Critical Interaction:** They are designed to work together, especially under Shield Advanced. During a suspected application-layer DDoS attack, Shield Advanced can automatically generate a WAF rule to rate-limit the offending traffic and deploy it to your web ACL, a process you would have to perform manually otherwise. Think of WAF as your finely-tuned, custom security gate, and Shield (particularly Advanced) as the automated flood defense system that activates when a massive surge attempts to overwhelm that gate.
In summary: Use **WAF** to enforce your specific application security policy. Use **Shield** (particularly Advanced) to gain AWS-managed, always-on DDoS resilience with integrated support and financial safeguards. Neglecting one for the other leaves a significant gap in your defense-in-depth strategy.
—chris
—chris