Client

NDA Protected Technology Client

Services used

Strengthening Web Application Security with AWS WAF and Shield

The client’s e-commerce application was receiving a steady stream of unwanted traffic. Automated bots were scraping data, attackers were probing for SQL injection and XSS vulnerabilities, and traffic floods had already caused brief periods of slowdown.

Bobcares added AWS WAF and AWS Shield to the existing AWS environment without changing the application code. Requests were filtered through WAF at the CloudFront edge, while Shield provided DDoS protection. Managed rules handled common web attacks, and custom rate controls helped deal with excessive requests and suspicious traffic.

Case Study Section

Business Challenge

The public-facing application needed protection from web exploits, malicious bots, and DDoS traffic without adding noticeable latency for legitimate users. The client also needed a security setup that could be monitored and adjusted as traffic patterns and attack attempts changed.

Technology Used

Amazon CloudFront Application Load Balancer AWS WAF AWS WAF Managed Rule Groups AWSManagedRulesCommonRuleSet AWSManagedRulesSQLiRuleSet AWSManagedRulesBotControl AWS Shield Standard AWS Shield Advanced Amazon CloudWatch

Blueprint

The existing CloudFront and ALB setup was retained, with AWS WAF added to inspect incoming HTTP/S requests before they reached the application. Shield handled DDoS protection, while managed WAF rules, custom rate-based rules, and monitoring controls addressed application-layer threats and abnormal traffic.

United States

E-commerce SaaS / Web Application Security

AWS WAF and DDoS Protection

Key Outcomes

Thousands of malicious requests blocked each week
SQL injection, XSS, and bot traffic filtered before reaching the application
Application remained online during a subsequent HTTP flood
Legitimate traffic continued at normal latency
Negligible false positives after rule tuning
Better visibility into blocked requests and traffic spikes
No application code changes required

Customer Profile

The client was a growing e-commerce SaaS provider running its public website on AWS. Amazon CloudFront delivered the website, with an Application Load Balancer serving as the backend entry point. Frequent catalog and promotion updates made availability important, while increasing attack traffic created a need for stronger protection.

The Challenges

The application was being probed for SQL injection, XSS, and other common web exploits
Automated scrapers were generating unwanted traffic
Credential attacks were targeting form submissions
Traffic spikes had already caused brief periods of slowdown
A larger DDoS or HTTP flood could affect application availability
Security controls needed to avoid slowing down legitimate users
The client wanted an AWS-native solution that would be manageable over time

Why Bobcares?

The client already had its application running behind CloudFront and an Application Load Balancer, so the security controls could be added without redesigning the application. AWS WAF and Shield provided the required protection while fitting into the existing traffic path.

AWS WAF could inspect HTTP/S requests before they reached the origin
Managed rule groups provided coverage for common web attacks
Bot Control could identify unwanted automated traffic
Rate-based rules could handle excessive request volumes
Shield provided always-on DDoS protection
CloudWatch provided a way to monitor the security controls

What We Delivered

Bobcares added the security controls around the existing AWS environment and tuned them against the client’s traffic before putting the blocking rules into production.

Created an AWS WAF Web ACL
Associated the Web ACL with the CloudFront distribution
Kept the default WAF action as
```
Allow
```
Added
```
AWSManagedRulesCommonRuleSet
```
for common web exploits
Added
```
AWSManagedRulesSQLiRuleSet
```
for SQL injection protection
Enabled
```
AWSManagedRulesBotControl
```
for automated traffic
Added rate-based rules for unusually high request volumes
Added IP allow and block lists for specific addresses
Added controls for suspicious geographic traffic
Started new rules in
```
Count
```
mode for 24 hours
Reviewed the resulting traffic before moving tuned rules to
```
Block
```
Kept AWS Shield Standard’s automatic DDoS protection enabled
Subscribed to AWS Shield Advanced on a trial basis
Used Shield Advanced for additional attack visibility and DDoS Response Team access
Enabled AWS WAF logging
Enabled Shield metrics through CloudWatch
Configured CloudWatch alarms for sudden increases in blocked requests and network traffic
Kept the application unchanged during the security implementation

The Results

Web Attack Protection

Before: The application was receiving SQL injection, XSS, bot, and other probing attempts
After: WAF blocked thousands of malicious requests each week before they reached the application

DDoS Resilience

Before: Traffic spikes had already caused brief periods of slowdown, creating concern about larger attacks
After: During an HTTP flood two weeks after deployment, Shield Standard absorbed the additional network traffic and WAF handled the application-layer impact. The site remained online with no reported DDoS-related downtime

Application Performance

Before: Additional security controls could have introduced latency for legitimate users
After: WAF operated at CloudFront edge locations, and legitimate traffic continued at normal latency

False Positives

Before: New blocking rules could potentially affect legitimate requests
After: Rules were tested in
```
Count
```
mode first and tuned before enforcement, resulting in negligible false positives

Security Visibility

Before: The team had limited visibility into attack traffic and unusual request patterns
After: WAF logs, Shield metrics, and CloudWatch alarms provided information about blocked requests and traffic spikes

Application Changes

Before: Security hardening could have required changes inside the application
After: WAF and Shield were added around the existing AWS environment without modifying application code

The Business Impact

Malicious traffic was stopped before reaching the application origin
The application remained available during a later HTTP flood
Security controls were added without application code changes
Legitimate users continued to receive normal application response times
Managed WAF rules reduced the amount of custom security rule maintenance required
The team gained better visibility into attack activity
The security setup could be adjusted as new traffic patterns appeared

Ongoing Collaboration

The security controls continue to be monitored and adjusted based on the traffic reaching the application.

Review WAF logs for new attack patterns
Monitor blocked requests and Shield metrics
Tune rules when legitimate traffic requires exceptions
Review CloudWatch alarms for unusual traffic increases
Continue using AWS-managed rule updates for common threat patterns
Use Shield Advanced during higher-risk or mission-critical periods when additional DDoS visibility and response support are required

Conclusion

The client did not need to change the application to address its growing security concerns. AWS WAF was added at the CloudFront layer to filter web attacks, while AWS Shield provided DDoS protection around the AWS environment.

Starting WAF rules in

Count

mode gave the team time to see how they behaved against real traffic before enabling blocking. The resulting setup now gives the e-commerce application protection against common web exploits, automated traffic, and DDoS activity while keeping the existing application architecture in place.