AWS WAF is a layer-7 web application firewall designed to protect web applications from common threats and attempts to exploit vulnerabilities that could compromise their availability and security posture. AWS WAF empowers users to define granular rules that monitor web requests to block high-risk fraudulent attempts.
In this Cloud Lab, you’ll explore how AWS WAF leverages account takeover prevention (ATP) and AWS account creation fraud prevention (ACFP) managed rule groups to strengthen application security. You’ll deploy a demo Flask app on EC2 behind an Application Load Balancer (ALB), serving simple sign-up and sign-in pages with no initial defenses, making it susceptible to credential stuffing and fake account creation attacks. Next, you’ll enable AWS WAF fraud controls to protect the application sign-in and sign-up endpoints. Finally, you’ll simulate automated traffic to validate that these protections safeguard your application from abuse, provide real-time visibility into fraud attempts, and effectively guard your web application.
The following is the high-level architecture diagram of the infrastructure you’ll create in this Cloud Lab:
