AWS SOA-C02 Drill: AWS WAF Rate-Based Rules - Controlling DDoS at the Edge

Jeff’s Note

#

Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Site Reliability Engineer (SRE).

For SOA-C02 candidates, the confusion often lies in misapplying WAF scopes—specifically, associating WAF Web ACLs with S3 buckets instead of CloudFront distributions. In production, this is about knowing exactly where to attach your web ACL so rate limiting and DDoS protections are effectively enforced *at the network edge, before the traffic hits your origin. Let’s drill down.

The Certification Drill (Simulated Question)

#

Scenario

#

BrightSky Media is a growing digital publishing company that hosts its public-facing marketing site in an Amazon S3 bucket located in the us-east-1 region. To improve global performance, BrightSky serves this content through an Amazon CloudFront distribution. The company is increasingly concerned about the website’s vulnerability to DDoS attacks and wants to implement application-level rate limiting to mitigate excessive request spikes.

The Requirement:

#

Deploy a solution that provides DDoS protection with control over application request rates to prevent malicious flooding, ensuring the rules are applied in a globally distributed manner consistent with best practices for edge security.

The Options:

#

• A) Deploy a global AWS WAF Web ACL with a default action of ALLOW. Configure an AWS WAF rate-based rule that BLOCKs traffic exceeding the rate limit. Associate the Web ACL with the CloudFront distribution.
• B) Deploy an AWS WAF Web ACL with a default action of ALLOW in the us-east-1 region. Configure an AWS WAF rate-based rule that BLOCKs traffic exceeding the rate limit. Associate the Web ACL directly with the S3 bucket.
• C) Deploy a global AWS WAF Web ACL with a default action of BLOCK. Configure an AWS WAF rate-based rule to ALLOW traffic that matches the rate limit. Associate the Web ACL with the CloudFront distribution.
• D) Deploy an AWS WAF Web ACL with a default action of BLOCK in the us-east-1 region. Configure an AWS WAF rate-based rule to ALLOW traffic that matches the rate limit. Associate the Web ACL directly with the S3 bucket.

Google adsense

#

leave a comment:

Correct Answer

#

A.

Quick Insight: The SysOps Imperative

#

• For SysOps roles, the crucial point is understanding AWS WAF’s regional scope. Since CloudFront is a global service, WAF must be deployed as a global Web ACL in the us-east-1 region and attached to the distribution. Associating WAF with an S3 bucket is only possible for regional resources like ALBs or API Gateway and won’t work for CloudFront.
• Rate-based rules use counts of IP requests over a 5-minute period to automatically block clients exceeding thresholds.
• Default action ALLOW with explicit BLOCK rules for rate-based limits provides precise control, avoiding accidental deny-all scenarios.

Content Locked: The Expert Analysis

#

You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?

The Expert’s Analysis

#

Correct Answer

#

Option A

The Winning Logic

#

AWS WAF with CloudFront works globally using a Web ACL deployed in the us-east-1 region—the control plane for global distributions. The S3 bucket itself does not support direct WAF association because it’s a regional service without native integration with WAF. By deploying a global Web ACL with a default “allow” action and a rate-based rule that “blocks” excessive requests, BrightSky Media ensures legitimate traffic flows unobstructed while malicious bursts are automatically dropped before reaching the origin.

This configuration also aligns with AWS Shield Advanced protections integrated into WAF at the edge—adding an additional DDoS mitigation layer. Using a default block with allow-rate-rules (Options C or D) flips the logic incorrectly, potentially blocking all traffic by default, which is rarely desirable.

The Trap (Distractor Analysis):

#

• Why not Option B or D?
  Associating a WAF Web ACL directly with an S3 bucket is invalid. S3 does not support AWS WAF integration; WAF only integrates with regional services like API Gateway, ALB, or global CloudFront in a global scope.
• Why not Options C or D?
  Setting the default action to BLOCK and then allowing rate-based traffic reverses intended filtering logic, increasing the risk of unintended denial of legitimate users. Rate-based rules are designed to block traffic exceeding limits, not allow.

The Technical Blueprint

#

# Example CLI snippet creating a global Web ACL with a rate-based rule and associating it with CloudFront

aws wafv2 create-web-acl \
  --name BrightSkyRateLimitACL \
  --scope CLOUDFRONT \
  --default-action Allow={} \
  --rules '[
    {
      "Name": "RateLimitRule",
      "Priority": 1,
      "Action": { "Block": {} },
      "Statement": {
        "RateBasedStatement": {
          "Limit": 2000,
          "AggregateKeyType": "IP"
        }
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "RateLimitRule"
      }
    }
  ]' \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=BrightSkyRateLimitACL

# Then associate with CloudFront distribution
aws wafv2 associate-web-acl --web-acl-arn <web-acl-arn> --resource-arn <cloudfront-distribution-arn>

The Comparative Analysis

#

Real-World Application (Practitioner Insight)

#

Exam Rule

#

For the exam, always pick a global WAF Web ACL with CloudFront when you need edge-based DDoS protection and rate-limiting for S3-hosted websites. WAF cannot be attached directly to S3 buckets.

Real World

#

In production, integrating AWS Shield Advanced alongside AWS WAF rate-based rules offers layered defense. Also, consider AWS Firewall Manager to centrally control and deploy WAF rules across multiple accounts and resources for large enterprises.

(CTA) Stop Guessing, Start Mastering

#

Disclaimer

This is a study note based on simulated scenarios for the SOA-C02 exam.