2.1.2.4. Application Security Services: WAF, Shield, Secrets Manager, Cognito (Lean List)

💡 First Principle: Application security services address distinct threat vectors by providing specialized protections, ensuring confidentiality, integrity, and availability for web applications, APIs, and user identities.

Securing applications on AWS involves specialized services that address distinct threat vectors, each grounded in fundamental security principles.

• AWS WAF (Web Application Firewall): A web application firewall that helps protect your web applications or APIs from common web exploits that may affect availability, compromise security, or consume excessive resources. Filters malicious web traffic (e.g., SQL injection, XSS) before it reaches your application, ensuring pre-emptive defense at the application layer.
• AWS Shield: A managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. Provides managed DDoS protection, automatically safeguarding applications from large-scale, volumetric attacks to maintain availability and resilience through scale.
• AWS Secrets Manager: Helps you protect access to your applications, services, and IT resources by enabling you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Securely stores, rotates, and retrieves sensitive credentials (e.g., database passwords, API keys), reducing manual handling and exposure risks, adhering to least privilege and automated lifecycle management.
• Amazon Cognito: Adds user sign-up, sign-in, and access control to your web and mobile apps. Enables secure user sign-up, sign-in, and access control for web/mobile applications, simplifying authentication/authorization at scale, aligned with centralized identity management.

Key Application Security Services:

• "AWS WAF": Protects web apps/APIs from common web exploits.
• "AWS Shield": Managed DDoS protection.
• "AWS Secrets Manager": Securely stores/rotates sensitive credentials.
• "Amazon Cognito": User authentication/authorization for apps.

Scenario: A company is deploying a new public-facing web application that handles user registrations and stores sensitive data. They need to protect it from web exploits and DDoS attacks, and securely manage its database credentials.

⚠️ Common Pitfall: Hardcoding sensitive credentials (like database passwords) directly into application code. This is a major security risk. Use Secrets Manager instead.

Key Trade-Offs:

• Protection (WAF/Shield) vs. Latency: While these services provide critical protection, they can introduce a minimal amount of latency due to traffic inspection. The security benefits typically outweigh this.

Reflection Question: How would you use a combination of AWS WAF, AWS Shield, and AWS Secrets Manager to provide layered security for this web application, addressing common application-level threats and secure credential management?