Network Protection Services Audit Surface
Explore how to identify and verify the appropriate AWS network protection services for filtering unwanted traffic. Learn to map symptoms to control layers, confirm service attachment points, and interpret logs and metrics for WAF, Shield, Network Firewall, and Resolver DNS Firewall. This lesson guides you through auditing these services effectively without unsafe testing by focusing on evidence like counters, logs, and metrics to ensure correct protection boundaries and minimize over-blocking.
Four different AWS services can sit between a client and a workload to filter unwanted traffic, and each one only makes sense at a specific point in the request path. A control positioned at the wrong boundary simply won't see the traffic it needs to see, which is why the real first step isn't choosing a service by name; it's identifying which boundary the failure is actually happening at.
A request that looks wrong only after the HTTP method, path, headers, or query string exist belongs at Layer 7, on the edge, with AWS WAF. A failure mode that's volumetric, traffic that exhausts bandwidth or connection capacity before application code even runs, points toward AWS Shield on that same edge surface. A problem with packets moving between subnets or VPCs belongs at Layer 3/4, inside routing, with AWS Network Firewall. A problem that starts when instances resolve names belongs at DNS resolution time, with Amazon Route 53 Resolver DNS Firewall.
These controls get proven active through attachment state, logs, and counters, not through attack simulations. WAF gets confirmed by checking that it's associated with a CloudFront distribution, Application Load Balancer, or API Gateway stage, then checking BlockedRequests and WAF logs for rule matches. Shield gets confirmed by checking that protection is enabled on the resource, then looking for DDoS-related metrics and events that show detection and mitigation activity. Network Firewall gets confirmed by checking that its endpoints sit in the VPC path through route tables, then inspecting firewall flow logs for allowed and dropped traffic. Resolver DNS Firewall gets confirmed by checking that rule groups are associated to the VPC, then inspecting DNS query logs for allowed and ...