Secure Workloads and Applications

Bundled into the existing AWS Certified Solutions Architect – Associate premium course — no separate purchase.

Included in this chapter:

WAF rule groups: managed vs custom, rate-based vs IP-set
Shield Advanced cost protection: when the $3 000/mo pays for itself
Security Group composition patterns: hub-and-spoke, mesh, transit
Network ACL ephemeral-port pitfalls + worked examples
Secrets Manager rotation Lambda: the 4-step contract + cross-account templates
VPC Endpoint policies: restricting which actions are allowed through an endpoint

Layer	Scope	Stateful?	Allow / Deny	Best for
WAF	L7 HTTP/HTTPS in front of CloudFront / ALB / API Gateway	—	Managed + custom rules	SQL injection, XSS, bad bots, geo-block, rate-based
Shield Standard	Network-edge L3/L4 (CloudFront, Route 53, GA)	—	Auto-protect	Common volumetric DDoS: free and on
Shield Advanced	Same + EIPs + ALB + custom resources	—	Shield Response Team (SRT)	$3 000/mo; large-scale DDoS + cost protection
Security Group	ENI (per-instance)	Stateful	Allow only	Per-instance allow-list; return traffic auto-allowed
Network ACL	Subnet	Stateless	Allow + Deny	Subnet-wide deny-list; needs explicit ephemeral-port rules
GuardDuty	Account-wide threat detection	—	Findings only	Anomaly detection from VPC Flow Logs, CloudTrail, DNS
Inspector	EC2 + ECR + Lambda vulnerability scan	—	Findings only	Software vulnerabilities, network reachability
Macie	S3 sensitive-data discovery	—	Findings only	PII / PHI / financial detection across S3

Cheat sheet

Layer your security controls so one misconfig isn't game over
Keep in-VPC traffic to AWS services off the internet with VPC endpoints
Security groups are stateful; NACLs are stateless
Need credentials that rotate? Use Secrets Manager, not static secrets
WAF only attaches to CloudFront, ALB, API Gateway, and AppSync
Shield Advanced costs $3,000/month per payer account, not per linked account
Secrets Manager rotation runs on a configurable cron/rate schedule
GuardDuty detects and Security Hub aggregates, but neither remediates
Static config goes in Parameter Store; auto-rotating credentials go in Secrets Manager
Auto-remediate GuardDuty findings with EventBridge → Lambda
Inspector continuously scans EC2, ECR, and Lambda for you automatically
For VPC-level traffic inspection across subnets, use AWS Network Firewall
Need zero auth failures during rotation? Use the alternating-users strategy
For OWASP Top 10 coverage with no maintenance, use AWS Managed Rules
Throttle HTTP floods per source IP with WAF rate-based rules
For tier-to-tier traffic, reference a security group ID as the source instead of a CIDR
WAF evaluates the lowest priority number first, and Allow and Block are terminating
To exclude specific traffic from a managed rule group, use a scope-down statement
Custom NACLs deny everything until you add allows, and rule number sets precedence
Lock S3 access to one VPC endpoint with a bucket policy using aws:SourceVpce

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet