Certablo
Sign inCreate account
← Knowledge Base
Security & Identitycomparison

AWS WAF & AWS Shield

Application-layer request filtering versus managed DDoS protection, with web ACL evaluation order, terminating actions, managed rule groups, rate-based controls, WCU capacity and Shield Standard versus Shield Advanced.

CLF-C02SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPLayered edge protection

Shield mitigates DDoS at its protection layer, WAF evaluates application requests, and CloudWatch exposes metrics for tuning and alerting.

AWS ShieldDDoS detection and mitigation
AWS WAFLayer 7 request rules
CloudWatchMetrics and operational visibility
EXAM-RELEVANT MECHANICS

Technical reference

WAF is ordered request-evaluation logic; Shield is a DDoS protection service. Treat rule behavior, capacity, and attack layer as separate variables.

Evaluation orderLowest numeric priority first

Each web ACL rule has a unique priority and is evaluated in ascending numeric order.

Terminating actionsAllow / Block

A terminating action ends evaluation and decides whether the request proceeds or is blocked.

Observation actionCount

Count records the match without terminating evaluation, which is useful for testing and layered logic.

FallbackWeb ACL default action

Applied only when rule evaluation reaches the end without a terminating decision.

Capacity metricWCU

Web ACL capacity units measure the processing resources required by rule statements and groups; they are not request-rate units.

Volumetric application controlRate-based rule

Aggregates requests using configured keys and enforces according to a configured rate threshold and action.

Service limits and capabilities can change. Values shown here reflect the current AWS documentation; use the linked official sources below as the source of truth.

WAF controls web requests; Shield focuses on DDoS resilience

AWS WAF is a web application firewall for supported AWS resources. A web ACL contains rules and rule groups that inspect HTTP/S request characteristics and decide whether to allow, block, count, challenge, or apply other supported actions. Typical criteria include IP addresses, request rate, headers, URI paths, query strings, geographic origin, and signatures represented by managed rule groups. WAF is therefore a Layer 7 request-inspection control rather than a general VPC network firewall.

AWS Shield provides managed DDoS protection. Shield Standard protections are available automatically to AWS customers and defend against common network and transport-layer DDoS attacks, with particular benefits for AWS edge services. Shield Advanced is a subscription service that adds enhanced detection, visibility, response assistance, cost protection features subject to its terms, and integrations for application-layer protections. The two services complement each other rather than being mutually exclusive.

WAF rule priority is executable logic

Rules in a web ACL have unique numeric priority values. AWS WAF evaluates from the lowest numeric priority upward. When a rule returns a terminating action such as Allow or Block, evaluation stops for that request. Count is non-terminating, and CAPTCHA or Challenge can behave as terminating or non-terminating depending on token state. If no terminating rule decides the request, the web ACL's default action applies.

Ordering can therefore change the effective policy even if the same rule set is present. A broad Allow placed too early can prevent later Block logic from running, while Count can be used to observe the effect of a rule before enforcing it. Labels set by managed or custom rules can be referenced by later rules, which makes priority relevant to multi-step detection logic as well as simple first-match behavior.

Capacity and DDoS controls are separate design dimensions

AWS WAF assigns web ACL capacity units (WCUs) to rules and rule groups to represent the processing capacity needed for their inspection logic. WCU is not a traffic-rate limit and does not describe how many requests an ACL can process; it is a configuration capacity model. Different statements and managed rule groups consume different capacity, so complex inspection should be designed within the current web ACL quotas and pricing model.

Rate-based WAF rules aggregate requests by configured keys and can apply an action when traffic exceeds a defined rate threshold, making them useful for abusive HTTP request patterns and as a component of Layer 7 DDoS defenses. Shield Advanced can integrate with WAF and, when configured, automatically manage application-layer mitigations for protected resources. Network/transport volumetric defense and HTTP request semantics remain distinct layers even when the services coordinate them.

Key takeaways

  1. 01

    AWS WAF inspects HTTP/S requests at Layer 7 using web ACL rules and rule groups.

  2. 02

    AWS WAF evaluates lower numeric priorities first and stops when a terminating rule action decides the request.

  3. 03

    WCUs represent rule-processing capacity, not request throughput or a rate limit.

  4. 04

    Shield Standard provides automatic baseline DDoS protection; Shield Advanced adds subscription-based capabilities and deeper WAF integration.

  5. 05

    Rate-based rules are WAF controls for request-volume patterns and can participate in application-layer DDoS defense.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.