AWS WAF and Shield Strengthened Application Security for a Logistics Platform
The client operated an AWS-based logistics platform connecting freight carriers and shippers through a web portal used by 300 partner companies. The environment used Route 53, CloudFront, an Application Load Balancer, ECS, and Aurora RDS.
Unusual account lockouts, excessive endpoint requests, and unexpected traffic spikes indicated potential application-layer threats. Bobcares analyzed traffic patterns before deploying AWS WAF protections, retained AWS Shield Standard, secured exposed resources, and established monitoring and rule-tuning processes to improve application protection without disrupting legitimate partner activity.
Business Challenge
The client needed to stop recurring CodeDeploy failures caused by memory exhaustion and insufficient disk space. Differences between EC2 instance types, AMIs, and EBS volumes were also making deployment behavior inconsistent.
Technology Used
Blueprint
Bobcares matched CodeDeploy deployment IDs with kernel logs and CloudWatch memory and disk data to see what was happening when deployments failed. The team then addressed the resource issues, added checks before deployment, controlled deployment batches, and put monitoring and recovery procedures around the process.
Key Outcomes
- Reduced malicious probing reaching the application origin.
- Reduced partner account lockouts caused by excessive login activity.
- Reduced infrastructure pressure from abnormal traffic spikes.
- Improved visibility into blocked requests and source IP activity.
- Reduced operational alerts related to abnormal application traffic.
- Established ongoing WAF rule maintenance and monitoring.
Customer Profile
The client was a mid-sized logistics company operating a web portal for freight carriers and shippers. The portal served 300 partner companies and supported shipment management, route information, and pricing-related access. Its AWS environment used CloudFront, an Application Load Balancer, ECS, and Aurora RDS. Reliable access was important because partner workflows depended on the portal.
The Challenges
- Partner accounts were being locked for unexplained reasons.
- Request volumes periodically exceeded expected activity levels.
- Route and pricing endpoints received unusually high request volumes.
- The application had no request-content or traffic-volume filtering at the edge.
- A legacy EC2 instance remained publicly exposed after an earlier migration.
- An S3 bucket had direct endpoint access despite the use of CloudFront.
- Managed WAF rules could potentially block legitimate security tools and third-party integrations.
- The appropriate threshold for application-specific rate limiting required analysis of historical traffic patterns.
- WAF maintenance requirements were initially underestimated.
Why Bobcares?
- Observed traffic patterns before enabling active request blocking.
- Used the client's existing AWS architecture instead of introducing unnecessary infrastructure.
- Tuned WAF protections around the application's actual traffic behavior.
- Identified legitimate integrations that could be affected by managed rule groups.
- Evaluated Shield Advanced against the client's actual threat profile instead of assuming the higher-tier service was necessary.
- Established visibility through CloudWatch before ongoing rule tuning.
What We Delivered
- Analyzed CloudFront and Application Load Balancer traffic patterns over an observation period.
- Created and associated a WAF Web ACL with CloudFront and the Application Load Balancer.
- Enabled selected managed rule groups in observation mode before activating blocking.
- Added exceptions for the internal penetration-testing suite and a third-party logistics data integrator.
- Developed a custom rate-based rule based on historical login and access patterns.
- Retained AWS Shield Standard after evaluating the need for Shield Advanced.
- Redirected exposed resources through the recommended architecture.
- Configured WAF logging to an S3 bucket.
- Built a CloudWatch dashboard for blocked requests and source IP activity.
- Investigated and corrected a post-deployment false positive involving integration retry behavior.
- Established ongoing WAF rule and configuration maintenance.
Results
Application-Layer Threat Filtering
- Before: SQL injection, XSS, and other suspicious probing attempts were reaching the application origin.
- After: Matching requests were blocked by WAF before reaching the origin, and the probing activity no longer appeared in the origin logs.
Partner Account Lockouts
- Before: Credential cycling against login endpoints contributed to repeated partner account lockouts.
- After: The rate-based rule restricted excessive requests before the activity could complete, resulting in a substantial reduction in account lockouts.
Infrastructure Pressure
- Before: Traffic spikes created scaling pressure on the ECS environment.
- After: Filtering part of the request load at the edge reduced the pressure reaching the origin infrastructure.
Operational Visibility
- Before: Abnormal traffic and account activity generated incidents that required investigation.
- After: WAF logs and the CloudWatch dashboard provided visibility into blocked requests, source IP ranges, and rule activity, reducing unexplained operational alerts.
Application Protection
- Before: External requests could reach the application without filtering based on request content or abnormal request rates.
- After: WAF managed rules and application-specific rate controls provided filtering before requests reached the origin.
The Business Impact
- Reduced disruption to partner access caused by abnormal login activity.
- Reduced unnecessary traffic reaching the application environment.
- Lowered infrastructure pressure during traffic spikes.
- Improved the operations team's ability to distinguish blocked threats from legitimate traffic.
- Reduced the need to investigate unexplained account and traffic anomalies.
- Strengthened the security posture of the client's public-facing AWS application.
Ongoing Collaboration
- Review WAF logs and blocked-request activity.
- Monitor CloudWatch security and traffic dashboards.
- Review managed rule-group changes and application compatibility.
- Revisit rate-based thresholds when application behavior changes.
- Investigate new false positives before they affect users or integrations.
- Maintain WAF rules as application integrations and traffic patterns evolve.
- Review security exposure and publicly accessible resources periodically.
Conclusion
The client's logistics portal was exposed to abnormal request activity without application-layer filtering. Bobcares introduced AWS WAF protections, tuned rate-based controls against observed traffic patterns, retained Shield Standard, and established ongoing monitoring. The resulting controls reduced malicious requests reaching the origin, lowered account lockouts and infrastructure pressure, and improved operational visibility.
