Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

2.1.2.4. Application Security Services: WAF, Shield, Secrets Manager, Cognito (Lean List)

2.1.2.4. Application Security Services: WAF, Shield, Secrets Manager, Cognito (Lean List)

💡 First Principle: Application security services address distinct threat vectors by providing specialized protections, ensuring confidentiality, integrity, and availability for web applications, APIs, and user identities.

Securing applications on AWS involves specialized services that address distinct threat vectors, each grounded in fundamental security principles.

  • AWS WAF (Web Application Firewall): A web application firewall that helps protect your web applications or APIs from common web exploits that may affect availability, compromise security, or consume excessive resources. Filters malicious web traffic (e.g., SQL injection, XSS) before it reaches your application, ensuring pre-emptive defense at the application layer.
  • AWS Shield: A managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. Provides managed DDoS protection, automatically safeguarding applications from large-scale, volumetric attacks to maintain availability and resilience through scale.
  • AWS Secrets Manager: Helps you protect access to your applications, services, and IT resources by enabling you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Securely stores, rotates, and retrieves sensitive credentials (e.g., database passwords, API keys), reducing manual handling and exposure risks, adhering to least privilege and automated lifecycle management.
  • Amazon Cognito: Adds user sign-up, sign-in, and access control to your web and mobile apps. Enables secure user sign-up, sign-in, and access control for web/mobile applications, simplifying authentication/authorization at scale, aligned with centralized identity management.
Key Application Security Services:
  • "AWS WAF": Protects web apps/APIs from common web exploits.
  • "AWS Shield": Managed DDoS protection.
  • "AWS Secrets Manager": Securely stores/rotates sensitive credentials.
  • "Amazon Cognito": User authentication/authorization for apps.
Distinctions the exam relies on:
  • Shield Standard vs. Advanced: Standard is automatic and free, covering common network- and transport-layer (L3/L4) DDoS attacks. Shield Advanced (paid, per protected resource) adds enhanced detection including application-layer attacks, 24/7 access to the Shield Response Team (SRT), cost protection against scaling charges caused by an attack, and AWS WAF at no extra charge for protected resources.
  • Where WAF attaches: Web ACLs associate with CloudFront distributions, Application Load Balancers, API Gateway REST APIs, AppSync, Cognito user pools and a few others — not with EC2 instances or Internet Gateways. Associating WAF with the CloudFront distribution filters requests at the edge, before they reach the origin.
  • Secrets Manager vs. Parameter Store: Both hold encrypted values that the application fetches at runtime, so a changed credential needs no redeploy. Only Secrets Manager has built-in automatic rotation (including managed rotation for RDS credentials); Parameter Store SecureString parameters have none.
  • Cognito user pools vs. identity pools: A user pool is the user directory — sign-up, sign-in and tokens. An identity pool exchanges those (or another IdP's) tokens for temporary AWS credentials to call services such as S3 directly. Apps that need both use them together.
Detection and discovery services (often confused):
ServiceWhat it does
Amazon GuardDutyAgentless threat detection: analyzes CloudTrail events, VPC Flow Logs and DNS logs with threat intelligence and machine learning — e.g. an instance contacting a known command-and-control server, or unusual API calls
Amazon MacieDiscovers and classifies sensitive data such as PII in S3
Amazon InspectorScans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure
AWS Security HubAggregates findings from these services and runs security posture checks; it is not itself a threat detector

Scenario: A company is deploying a new public-facing web application that handles user registrations and stores sensitive data. They need to protect it from web exploits and DDoS attacks, and securely manage its database credentials.

⚠️ Common Pitfall: Hardcoding sensitive credentials (like database passwords) directly into application code. This is a major security risk. Use Secrets Manager instead.

Key Trade-Offs:
  • Protection (WAF/Shield) vs. Latency: While these services provide critical protection, they can introduce a minimal amount of latency due to traffic inspection. The security benefits typically outweigh this.

Reflection Question: How would you use a combination of AWS WAF, AWS Shield, and AWS Secrets Manager to provide layered security for this web application, addressing common application-level threats and secure credential management?

See how it connects
Start with 40 free practice questions
Alvin Varughese
Written byAlvin Varughese
Founder•20 professional certifications