4.1.3. Edge Controls and Rules (Geo, Rate Limiting, Fingerprinting)

First Principle: Edge rules enable granular control over who can access your resources based on geography, behavior patterns, and client characteristics — filtering illegitimate traffic before it consumes compute resources.

Geographic Controls:

• CloudFront Geo Restriction: Block or allow requests from specific countries based on IP geolocation
• WAF Geo-Match Condition: Create rules that match requests from specific countries, enabling complex logic (e.g., allow US but block if request rate exceeds threshold)
• Use case: block access from countries where you have no customers, or apply stricter scrutiny to regions with high attack traffic

Rate Limiting:

• WAF Rate-Based Rules: Block IPs that exceed a defined request threshold within an evaluation window of 1, 2, 5 (default) or 10 minutes
• Minimum rate limit: 10 requests per evaluation window
• Can scope to specific URI paths, query strings, or headers
• Automatically unblocks when rate drops below threshold

Client Fingerprinting:

• WAF Bot Control: Uses browser fingerprinting, CAPTCHA challenges, and behavioral analysis to distinguish humans from bots
• Challenge actions: WAF can issue silent challenges (JavaScript) or visible CAPTCHAs
• Client IP reputation: WAF integrates with AWS threat intelligence to block known malicious IPs

⚠️ Exam Trap: Rate-based rules count requests per aggregation key (by default, per source IP). A distributed attack in which every IP stays under the limit never trips them, and pushing the limit toward its minimum of 10 mostly blocks legitimate users. Behavior-based controls such as Bot Control close that gap.

Scenario: An e-commerce site experiences a credential stuffing attack from distributed IPs, each sending only a handful of login attempts. WAF rate-based rules alone can't block them because each IP stays under any limit that wouldn't also block real users. You add WAF Bot Control to detect and challenge automated login attempts.

Reflection Question: Why are rate-based rules insufficient against distributed attacks, and how does bot detection close this gap?