Project: DDoS-Resilient Architecture with Shield, WAF, CloudFront, Route 53 and ALB

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday project brief

Ananya Iyer’s Bengaluru B2B CRM must stay up through festive traffic and opportunistic DDoS. Public DNS on Route 53, CloudFront in front, WAF on the distribution, origin ALB + ASG in ap-south-1, Shield Advanced on the org, Firewall Manager policy for baseline WAF rules across accounts. Runbooks for L3/L4 vs L7 incidents.

CloudFront distribution + HTTPS/OAC details: survey chapter. WAF rule deep-dive: previous two chapters. Shield buy decision: chapter 3.

2. Why layered resilience?

Why do we need this?

One control fails open or false-positives. Layers: DNS health+failover (Route 53), edge cache+TLS (CloudFront), volumetric (Shield), HTTP rules (WAF), healthy capacity (ALB/ASG), org baseline (Firewall Manager), humans (runbooks/SRT).

3. What is the reference architecture?

What is it?

1. Route 53: alias to CloudFront; health checks; optional failover to static status page
2. CloudFront: TLS, caching, OAC to origins as needed
3. WAF (CLOUDFRONT scope, us-east-1): managed CRS/SQLi Count→Block, rate /login, geo as needed
4. Shield Advanced: protect CF/R53/ALB; health-based; protection group “crm-public”
5. ALB + ASG: max capacity caps; WAF REGIONAL optional defense-in-depth
6. Firewall Manager: org policy for required WAF rule groups on all public ACLs
7. Logging: WAF → Firehose → SIEM; CF/ALB access logs; Shield metrics alarms

4. How to wire it (checklist + CLI sketches)

How to do it (step by step)

# 0) Decisions
# - Shield Advanced: yes (memo from ch3)
# - WAF scope for public: CLOUDFRONT in us-east-1
# - Regional WAF on ALB: optional second layer

# 1) Web ACL (us-east-1, CLOUDFRONT) — rules from ch2 pattern
aws wafv2 create-web-acl --name crm-public-edge --scope CLOUDFRONT --region us-east-1 \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=crmPublicEdge \
  --rules file://edge-rules.json

# 2) Attach to CloudFront distribution (WebACLId = ACL ARN)
# (distribution create/update — see survey chapter for HTTPS/OAC)

# 3) Route 53 alias A/AAAA to CloudFront; health check on /health
# 4) Shield Advanced protections on CF, R53 hosted zone, ALB; create protection group
# 5) Firewall Manager security policy: WAFv2 → associate to CloudFront resources in org OUs
# 6) Alarms: Shield DDoS detected, WAF BlockedRequests spike, ALB 5xx, ASG at MaxSize

5. Firewall Manager role

AWS Firewall Manager centrally deploys WAF rule groups, Shield Advanced policy, security groups, and network firewall policies across accounts. For this project: a WAFv2 policy that requires CRS+SQLi on every CloudFront Web ACL in the “Public” OU, with a Change Administrator account owning the policy.

6. Incident runbooks

Runbook A — suspected L3/L4 volumetric

1. Declare incident; page on-call + security.
2. Check Shield console / CloudWatch for DDoSDetected.
3. Confirm Route 53 and CloudFront still resolve/serve cache.
4. If Advanced: engage SRT with attack start time + protected resource ARNs.
5. Raise ASG max only within pre-approved caps; watch bill.
6. Comms: status page via R53 failover if origin sick.
7. Hourly notes; preserve metrics for cost protection claim.

Runbook B — suspected L7 HTTP flood / abuse

1. Check WAF BlockedRequests and Top rules in sampled/logs.
2. Tighten rate-based on hot URIs; temporary emergency IP Block at prio 10.
3. Flip relevant Count→Block if already validated.
4. CAPTCHA/Challenge on browser paths only.
5. If Advanced + severe: SRT for L7 guidance.
6. Post-incident: keep emergency rules with expiry date in ticket.

Runbook C — false positive outage

1. Identify ruleId from 403 logs.
2. Override that rule to Count or add narrow Allow at higher priority.
3. Never delete the whole Web ACL under pressure.
4. Customer comms: “security filter false positive, mitigated”.

7. Multi-industry variants

• Ecommerce flash sale (Lucas Meyer): Bot Control + 429 custom + ASG scheduled scale
• Fintech (Arjun Mehta): stricter rate on /pay /otp; no Challenge on APIs
• Healthcare (Priya Nair): geo allow + CRS; PHI stays off edge logs (redact)
• Gaming (Mei Chen): Shield Advanced mandatory; protection group per title
• Gov (Rahul Deshmukh): FMS org-wide; CAPTCHA on forms; SRT tabletop yearly

8. Lab: architecture diagram + tabletop + mini proof

Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.

How to do it (step by step)

1. Draw the reference architecture with ARNs placeholders for your lab account.
2. Create (or reuse) CLOUDFRONT Web ACL in us-east-1; attach to a lab distribution.
3. Add rate rule; curl flood lab path → 403; save proof.
4. Write Runbook A/B/C one-pagers in the repo.
5. Draft Firewall Manager policy text (even if org lacks FMS — as design).

Cleanup (stop billing)

1. Disassociate lab Web ACL; delete lab ACL/IP sets if dedicated.
2. Revert any emergency prio-10 rules.
3. Do not leave Shield Advanced enabled without budget owner sign-off.

9. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

10. Troubleshooting checklist

1. Confirm Web ACL scope matches resource type.
2. Open Sampled requests for the last 3 hours.
3. Diff priorities: is an Allow above your Block?
4. curl -v with and without the attack payload.
5. Check WAF logs in S3/Firehose for ruleId and action.
6. For CloudFront: confirm us-east-1 Web ACL and distribution id.
7. For ALB: confirm association ARN equals the listener’s load balancer.
8. If Shield Advanced: check protection status and health checks.

11. FAQ

12. Interview Q&A

13. Tips in English, Marathi and Hindi

14. WAF design checklist before you publish

1. Write the threat in one sentence (bot scrape, SQLi, credential stuffing, country block).
2. Choose scope: CloudFront (global) vs regional (ALB/API GW/AppSync).
3. List default action: Allow with Block rules, or Block with Allow exceptions.
4. Decide priority bands: 0–99 emergency, 100–499 allowlists, 500–899 managed, 900+ rate.
5. Start risky new rules in Count for 24–72 hours, then flip to Block.
6. Plan CAPTCHA/Challenge only where a human can solve them (not pure APIs).
7. Enable logging to S3 or Firehose before the first Block go-live.
8. Document the curl allow test and the 403 deny test.
9. Name the owner on-call for false-positive unlocks.
10. Link back to the CloudFront+WAF survey chapter for CDN/HTTPS basics.

15. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

16. Priority bands that interviewers love

• 0–99: emergency Block / IP denylist (fastest kill switch)
• 100–199: explicit Allow for partners / health checks / office IP
• 200–499: geo / ASN / bot control early filters
• 500–799: AWS Managed Rules (SQLi, XSS, WordPress, Linux, Windows)
• 800–899: custom body / header / URI matches
• 900–999: rate-based rules (last line before default)

Lower number = higher priority. First matching terminating action wins. Count never terminates — evaluation continues.

17. Industry story bank (reuse the pattern)

Use the same WAF pattern across industries — only change IP sets, geo lists, URI paths, and rate thresholds.

• Fintech (Arjun Mehta, UPI wallet, Mumbai): rate-limit /login and /otp; CAPTCHA on password reset.
• Healthcare (Priya Nair, clinic portal, Kochi): geo allow India+UAE; Block SQLi on /api/patients.
• EdTech (Sofia Alvarez, LMS, Bogotá): Challenge on scraping /courses; Allow CDN health.
• Ecommerce (Lucas Meyer, D2C, Berlin): Bot Control on flash-sale; custom 429 HTML.
• Media (Fatima Khan, newsroom, Dubai): rate on /search; Block known bad ASNs.
• SaaS (Ananya Iyer, B2B CRM, Bengaluru): IP allow partner webhooks; Block rest on /hooks.
• Logistics (Kenji Watanabe, fleet API, Tokyo): geo Japan+SG; rate on /track.
• Government (Rahul Deshmukh, state portal, Nagpur): managed Core Rule Set + CAPTCHA on forms.
• Gaming (Mei Chen, matchmaking API, Singapore): Shield Advanced + WAF rate on /join.
• Travel (Amina Okello, booking, Nairobi): geo allow Africa+EU partners; Block card-testing paths.

18. False-positive unlock runbook

1. Find the blocked request in Sampled requests or WAF logs (rule id + label).
2. Reproduce with curl -v and the same headers/body.
3. If Count would have been enough, flip Block→Count for that rule only.
4. Add a narrow Allow rule at higher priority (specific URI + IP) rather than disabling the whole managed group.
5. Label-match exclusions inside managed rule groups when AWS supports them for that group.
6. Re-test allow and deny paths; leave a ticket with request id.
7. Never set default action to Allow and delete all rules under pressure.

19. What good looks like in a PR review

• Scope (REGIONAL vs CLOUDFRONT) matches the resource.
• Priorities documented in a table in the PR.
• New managed rules started in Count with a flip date.
• Logging destination exists and is encrypted.
• curl 200 and curl 403 proofs pasted.
• Link to CloudFront+WAF survey for CDN/TLS context.
• Shield Advanced decision recorded (yes/no + reason).

20. Related chapters on this site

• CloudFront + WAF survey (CDN, HTTPS, light WAF): open chapter
• Well-Architected Framework (security pillar context): next chapter after this series.
• S3 bucket policy projects (origin hardening behind OAC).

21. Metric and alarm starter pack

Create these CloudWatch alarms on day one so an attack is not a Slack surprise. Thresholds are starting points — tune per app.

• WAF BlockedRequests Sum > N for 5 minutes on the Web ACL metric
• WAF CountedRequests Sum high on a rule still in Count (review before flip)
• ALB HTTPCode_Target_5XX_Count spike
• ASG GroupInServiceInstances at MaxSize for 10 minutes
• Shield Advanced DDoSDetected = 1 (if subscribed)
• CloudFront 4xx/5xx error rate
• Route 53 health check Unhealthy
• WAF logging delivery errors (Firehose throttles)

22. Sampled requests reading guide

1. Open Web ACL → Sampled requests → pick a rule.
2. Note action (Count/Block), URI, country, and matched data.
3. Decide: true positive (keep Block), false positive (Count or exclude), or need CAPTCHA.
4. Export request ids into the ticket for auditors.
5. Never tune only from memory — tune from samples + logs.

23. WAF + Shield glossary (exam friendly)

24. Fifteen-minute tabletop script

1. Minute 0–2: Inject scenario (“CF 5xx + Shield metric up” or “login 403 storm”).
2. Minute 2–5: Classify L3/L4 vs L7; name the runbook.
3. Minute 5–10: Say aloud the first three console clicks + who to page.
4. Minute 10–13: Customer comms one-liner.
5. Minute 13–15: Note one gap to fix in the real runbook.

25. Cost notes (approximate mindset)

WAF charges for Web ACLs, rules, and request units; Bot Control/ATP add-ons cost more. Shield Advanced has a monthly org fee plus data-transfer related charges — confirm on the AWS pricing page the day you buy. Logging to Firehose/S3/CW adds storage and throughput cost. Always set budgets.

26. Security hygiene beyond WAF

• Lock origins so clients cannot bypass CloudFront (SG, OAC, custom header).
• Least-privilege IAM for wafv2:* on deploy roles.
• Encrypt log buckets; block public access on log buckets.
• Quarterly review of IP sets and geo lists (people travel; offices move).
• Redact Authorization and cookie headers in WAF logs.
• Keep a break-glass Allow rule documented but disabled.

27. Pairing with other AWS chapters on this site

Read S3 policy projects when hardening origins behind OAC. Read Well-Architected (next after this series) for the security pillar checklist. Read the CloudFront+WAF survey when you need CDN caching and HTTPS step-by-step.

28. Request flow deep dive (teacher board)

A browser hits https://app.example.com/login. DNS (Route 53) returns CloudFront. TLS ends at CloudFront. WAF Web ACL (CLOUDFRONT, us-east-1) evaluates rules by priority. A Count rule on CRS may label the request. A rate-based rule may Block with 403. If Allow, CloudFront cache or origin fetch runs. Origin ALB may have a second REGIONAL Web ACL. Shield watches volumetric patterns the whole time. Logs land in S3/Firehose for the SOC.

1. DNS resolve and TLS handshake (Shield sees floods here).
2. WAF evaluation at edge (L7).
3. Cache hit/miss at CloudFront.
4. Origin request to ALB; optional regional WAF.
5. ASG target serves app; health checks continue.
6. Metrics + logs + optional SRT.

29. Rule JSON anatomy (read aloud)

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

30. Text transformations cheat sheet

• LOWERCASE — normalise path/header compares
• URL_DECODE / URL_DECODE_UNI — catch encoded probes
• HTML_ENTITY_DECODE — body HTML tricks
• CMD_LINE — OS command obfuscation (with care)
• Compress whitespace / Strip — reduce bypass noise
• Apply in priority order inside the rule

31. Office-hours mini drills (students)

1. Drill 1: Explain why Count does not stop later rules (2 minutes).
2. Drill 2: Given priorities 10 Block IP, 100 Allow /health, 500 CRS — what happens to office IP hitting /health?
3. Drill 3: Write curl that should 403 under SQLi Block.
4. Drill 4: Name three Shield Advanced-only features.
5. Drill 5: Sketch Runbook B first three steps from memory.
6. Drill 6: Where must a CloudFront Web ACL be created?
7. Drill 7: Who wins — managed Block vs later Allow at higher number?
8. Drill 8: Redact which headers in WAF logs for a bank?

32. Change calendar (safe rollout)

• Day 0: ACL + logging + Allow default + health Allow rule
• Day 1: Managed groups in Count
• Day 2–3: Review sampled; add exclusions
• Day 4: Flip SQLi/CRS to Block off-peak
• Day 5: Rate-based on /login in Count then Block
• Day 7: CAPTCHA on password reset only
• Day 14: Firewall Manager baseline if org-ready
• Day 30: Tabletop + Advanced decision revisit

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.