Secure Workloads and Applications

Bundled into the existing AWS Certified Solutions Architect – Associate premium course — no separate purchase.

Included in this chapter:

WAF rule groups: managed vs custom, rate-based vs IP-set
Shield Advanced cost protection: when the $3 000/mo pays for itself
Security Group composition patterns: hub-and-spoke, mesh, transit
Network ACL ephemeral-port pitfalls + worked examples
Secrets Manager rotation Lambda: the 4-step contract + cross-account templates
VPC Endpoint policies: restricting which actions are allowed through an endpoint

Layer	Scope	Stateful?	Allow / Deny	Best for
WAF	L7 HTTP/HTTPS in front of CloudFront / ALB / API Gateway	—	Managed + custom rules	SQL injection, XSS, bad bots, geo-block, rate-based
Shield Standard	Network-edge L3/L4 (CloudFront, Route 53, GA)	—	Auto-protect	Common volumetric DDoS — free and on
Shield Advanced	Same + EIPs + ALB + custom resources	—	Shield Response Team (SRT)	$3 000/mo; large-scale DDoS + cost protection
Security Group	ENI (per-instance)	Stateful	Allow only	Per-instance allow-list; return traffic auto-allowed
Network ACL	Subnet	Stateless	Allow + Deny	Subnet-wide deny-list; needs explicit ephemeral-port rules
GuardDuty	Account-wide threat detection	—	Findings only	Anomaly detection from VPC Flow Logs, CloudTrail, DNS
Inspector	EC2 + ECR + Lambda vulnerability scan	—	Findings only	Software vulnerabilities, network reachability
Macie	S3 sensitive-data discovery	—	Findings only	PII / PHI / financial detection across S3

Cheat sheet

Defense in depth — never a single fence
VPC endpoints + PrivateLink keep AWS traffic off the internet
Security Groups stateful, NACLs stateless
Secrets Manager + rotation beats static credentials
WAF only attaches to CloudFront, ALB, API Gateway, AppSync
Shield Advanced: $3 000/month per payer account
Secrets Manager rotation: configurable schedule (commonly 30 / 60 / 90 days)
GuardDuty + Security Hub for org-wide detection
Parameter Store SecureString vs Secrets Manager
GuardDuty findings flow → EventBridge → Lambda for auto-response
Inspector scans EC2 + ECR + Lambda automatically
Network Firewall: stateful + managed rule groups for VPC-level inspection
Alternating-users rotation strategy eliminates credential downtime
AWS Managed Rules provide OWASP Top 10 coverage with zero maintenance
WAF rate-based rules automatically block IPs exceeding a request threshold
Reference a security group ID as source to avoid IP management
WAF evaluates rules lowest-priority-number first; Allow and Block are terminating
WAF scope-down statements exclude specific traffic from a managed rule group
Custom NACLs deny all traffic by default; rule order determines precedence
Use aws:SourceVpce or aws:SourceVpc to restrict S3 access to a specific VPC endpoint or VPC

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet