This document discusses using Amazon CloudFront, AWS WAF, and AWS Lambda to protect web applications. AWS WAF provides firewall protection at CloudFront edge locations and can block exploits, abuse, and application DDoS attacks. CloudFront works with AWS WAF to filter legitimate traffic from attacks like SQL injection, cross-site scripting, and others. AWS Lambda can be used to automate security by integrating IP reputation lists and detecting HTTP floods and scans/probes. Resources are provided for webinars and tutorials on configuring AWS WAF and AWS Lambda for automatic protection of web applications.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Alessandro Esposito – Cloudfront Account Representative
esposita@amazon.lu
24th May 2016
Protect your web applications
Using Amazon CloudFront, AWS WAF and AWS Lambda

2. AWS WAF - Web Application Firewall
• WAF protection at the Edge Location
• Full-feature API
• Integrated with Amazon CloudFront
• Exploits, abuse, and application DDoS protection
• Easy to deploy and mantain
• Pay as you goAWS WAF

3. Amazon CloudFront with AWS WAF
Amazon CloudFront
site
scraping
SQL Injection,
XSS, other attacks
legitimate
traffic
Edge
Location
AWS
WAF
EC2ELBS3
AND/OR
On Premises Environment
Origin Server Origin Storage

4. Automated Security

5. IP reputation lists

6. HTTP floods

7. AWSLABS – CloudFormation templates available
https://github.com/awslabs/aws-waf-sample

8. <demo>

9. Types of attacks that need automation
HTTP floods Scans & probesIP reputation lists Bots & scrapers
Attackers

10. Resources
• Webinar | Introducing AWS WAF
http://bit.ly/1N63GvO
• Webinar | Using Using AWS WAF and Lambda for Automatic Protection
http://bit.ly/1qFLBe9
• Preconfigured Rules & Tutorials for AWS WAF
http://aws.amazon.com/waf/preconfiguredrules/
• How to import reputation lists automatically:
https://blogs.aws.amazon.com/security/post/Tx8GZBDD7HJ6BS/How-to-
Import-IP-Address-Reputation-Lists-to-Automatically-Update-AWS-WAF-IP-
Bla
• How to configure rate-based blacklisting:
http://blogs.aws.amazon.com/security/post/Tx1ZTM4DT0HRH0K/How-to-
Configure-Rate-Based-Blacklisting-with-AWS-WAF-and-AWS-Lambda

11. Thank You!