Project: Shield, WAF, CloudFront, Route 53 आणि ALB सह DDoS-Resilient Architecture

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Project brief

Ananya Iyer (बेंगळुरू CRM): R53 → CF+WAF → ALB/ASG, Shield Advanced, Firewall Manager, L3/L4 vs L7 runbooks.

CF/HTTPS: survey. WAF = ch1–2. Shield = ch3.

2. Layered resilience का?

हे का लागतं?

एक control अपुरा. DNS + edge + Shield + WAF + ASG + FMS + humans.

3. Reference architecture काय?

हे काय आहे?

1. R53 alias + health + failover
2. CF TLS/cache/OAC
3. WAF on CF
4. Shield Advanced
5. ALB/ASG + caps
6. FMS baseline
7. Logging+alarms

4. How: checklist + CLI

कसं करायचं (step by step)

# 0) Decisions
# - Shield Advanced: yes (memo from ch3)
# - WAF scope for public: CLOUDFRONT in us-east-1
# - Regional WAF on ALB: optional second layer

# 1) Web ACL (us-east-1, CLOUDFRONT) — rules from ch2 pattern
aws wafv2 create-web-acl --name crm-public-edge --scope CLOUDFRONT --region us-east-1 \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=crmPublicEdge \
  --rules file://edge-rules.json

# 2) Attach to CloudFront distribution (WebACLId = ACL ARN)
# (distribution create/update — see survey chapter for HTTPS/OAC)

# 3) Route 53 alias A/AAAA to CloudFront; health check on /health
# 4) Shield Advanced protections on CF, R53 hosted zone, ALB; create protection group
# 5) Firewall Manager security policy: WAFv2 → associate to CloudFront resources in org OUs
# 6) Alarms: Shield DDoS detected, WAF BlockedRequests spike, ALB 5xx, ASG at MaxSize

5. Firewall Manager

FMS = central WAF/Shield/SG policies. इथे: Public OU वर CRS+SQLi required.

6. Incident runbooks

Runbook A — L3/L4

1. Declare + page.
2. Shield metrics.
3. DNS/edge up?
4. Engage SRT.
5. ASG caps.
6. Status page.
7. Evidence.

Runbook B — L7

1. WAF metrics.
2. Tighten rules.
3. Count→Block.
4. CAPTCHA browsers.
5. SRT L7.
6. Expiry ticket.

Runbook C — false positive

1. ruleId.
2. Count/Allow.
3. ACL delete नको.
4. Comms.

7. Multi-industry

• Ecommerce flash
• Fintech APIs
• Healthcare redact
• Gaming titles
• Gov FMS

8. Lab: diagram + tabletop + proof

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Draw diagram.
2. ACL+CF.
3. 403 proof.
4. Runbooks.
5. FMS draft.

Cleanup (billing थांबवा)

1. Cleanup ACL.
2. Revert emergency.
3. Shield budget.

9. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

10. Troubleshooting checklist

1. Scope check.
2. Sampled requests.
3. Priority order.
4. curl -v.
5. Log ruleId.
6. CF region.
7. ALB ARN.
8. Shield health.

11. FAQ

12. Interview Q&A

13. Tips — English, मराठी आणि हिंदी

14. Publish करण्याआधी WAF checklist

1. Threat एका वाक्यात.
2. Global vs regional scope.
3. Default action.
4. Priority bands.
5. Count first.
6. CAPTCHA for humans.
7. Logging first.
8. Allow + 403 tests.
9. On-call owner.
10. CF+WAF survey link.

15. Copy-paste WAF CLI runbook

# Region for REGIONAL Web ACL (ALB / API GW). Use --scope CLOUDFRONT + us-east-1 for CDN.
export AWS_REGION=ap-south-1
export NAME=rb-waf-lab-$(date +%s)

# IP set (office allowlist example)
aws wafv2 create-ip-set --name $NAME-office --scope REGIONAL --region $AWS_REGION \
  --ip-address-version IPV4 --addresses 203.0.113.10/32

# Web ACL skeleton (default Allow; add rules in console or JSON)
aws wafv2 create-web-acl --name $NAME --scope REGIONAL --region $AWS_REGION \
  --default-action Allow={} --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=$NAME \
  --rules file://rules.json

# Associate to ALB
aws wafv2 associate-web-acl --web-acl-arn $WEB_ACL_ARN --resource-arn $ALB_ARN --region $AWS_REGION

# Logging
aws wafv2 put-logging-configuration --logging-configuration \
  ResourceArn=$WEB_ACL_ARN,LogDestinationConfigs=$LOG_BUCKET_ARN

# Test
curl -s -o /dev/null -w "%{http_code}\n" https://app.example.com/
# expect 200 for allow path; 403 for blocked path

16. Interview-friendly priority bands

• 0–99: emergency Block
• 100–199: Allow exceptions
• 200–499: geo/bot
• 500–799: Managed Rules
• 800–899: custom
• 900–999: rate-based

छोटा number = उच्च priority. पहिला terminating action जिंकतो. Count terminate होत नाही.

17. Industry story bank

एकच WAF pattern; फक्त IP/geo/URI/rate बदला.

• Fintech: /login /otp rate + CAPTCHA.
• Healthcare: geo + SQLi.
• EdTech: Challenge scrapers.
• Ecommerce: Bot + 429.
• Media: search rate.
• SaaS: webhook allowlist.
• Logistics: geo + rate.
• Gov: CRS + CAPTCHA.
• Gaming: Shield + rate.
• Travel: geo + card-test block.

18. False-positive unlock runbook

1. Sampled / logs → rule id.
2. curl -v reproduce.
3. Block→Count.
4. Narrow Allow above.
5. Label exclusions.
6. Retest + ticket.
7. Default Allow + empty नको.

19. PR review checklist

• Correct scope.
• Priority table.
• Count → Block date.
• Logs encrypted.
• 200 + 403 proofs.
• Survey link.
• Shield decision.

20. या site वरील related chapters

• CF+WAF survey: chapter
• Well-Architected — पुढचा.
• S3 policy projects.

21. Metric आणि alarm starter pack

Day-one alarms. Thresholds = starting points.

• BlockedRequests spike
• CountedRequests review
• ALB 5xx
• ASG at max
• DDoSDetected
• CF error rate
• R53 unhealthy
• Log delivery

22. Sampled requests वाचन

1. Sampled → rule.
2. Action/URI/country.
3. TP/FP/CAPTCHA.
4. Request ids → ticket.
5. Samples+logs.

23. Glossary

24. 15-minute tabletop

1. Scenario inject.
2. Classify.
3. First clicks + page.
4. Comms.
5. Gap note.

25. Cost notes

WAF = ACL+rules+requests; Bot/ATP जास्त. Shield Advanced = monthly+usage. Logs = storage. Budgets ठेवा.

26. WAF पलीकडे hygiene

• No CF bypass.
• IAM least privilege.
• Log bucket BPA.
• Quarterly IP/geo.
• Redact secrets.
• Break-glass doc.

27. इतर chapters शी pairing

Origin OAC = S3 projects. Security pillar = Well-Architected. CDN/HTTPS = CF+WAF survey.

28. Request flow deep dive

Browser → R53 → CF → WAF → (ALB WAF) → app. Shield पहातो. Logs → SOC.

1. DNS+TLS (Shield).
2. Edge WAF.
3. Cache.
4. Origin + regional WAF.
5. ASG serve.
6. Metrics/logs/SRT.

29. Rule JSON anatomy

{
  "Name": "RateLogin1000",
  "Priority": 900,
  "Action": {"Block": {"CustomResponse": {"ResponseCode": 429}}},
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLogin1000"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {"UriPath": {}},
          "TextTransformations": [{"Priority": 0, "Type": "LOWERCASE"}],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  }
}

30. Text transformations

• LOWERCASE
• URL_DECODE
• HTML_ENTITY_DECODE
• CMD_LINE
• Compress/Strip
• Ordered transforms

31. Office-hours drills

1. Drill 1 Count.
2. Drill 2 priority.
3. Drill 3 curl.
4. Drill 4 Shield.
5. Drill 5 runbook.
6. Drill 6 region.
7. Drill 7 order.
8. Drill 8 redact.

32. Change calendar

• Day 0
• Day 1
• Day 2–3
• Day 4
• Day 5
• Day 7
• Day 14
• Day 30

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.