DDoS floods, bot abuse, and malware calling home over DNS all arrive over the network. A practical walkthrough of the AWS network security layers most teams leave at their defaults, and which ones to turn on first.
When people picture a breach, they imagine a clever exploit or a stolen password. In practice, a lot of the abuse your cloud workloads receive is traffic-level: DDoS floods against public endpoints, bots hammering login pages, exploit scanners probing your web front door, and compromised instances quietly calling home over DNS. Teams invest in IAM and patching, as they should, and then leave the network layers at their defaults.
The strange part is that AWS ships managed defenses for every one of these layers, and several of them cost little or nothing. They just need someone to turn them on properly.
Delivering applications through Amazon CloudFront means traffic lands on the AWS global edge network first, not your origin. Volumetric floods get absorbed by infrastructure built to absorb them. Attach AWS WAF and you can block common web exploits like SQL injection and cross-site scripting, throttle rate abuse, and filter bots, using managed rule groups that AWS maintains for you. AWS Shield Standard is already on for every AWS customer at no additional cost, and Shield Advanced adds 24/7 access to the AWS Shield Response Team plus protection against DDoS-related cost spikes for workloads that genuinely need it.
Security groups and NACLs are your first line inside AWS, but they don’t inspect traffic, and per-VPC rules get messy fast. AWS Network Firewall gives you a managed firewall with intrusion detection and prevention, backed by AWS-maintained threat intelligence. The most valuable rule set is often the least glamorous: egress filtering, so a compromised workload can’t phone out to known-bad destinations.
This is the layer almost everyone skips. If an instance is compromised, malware needs to reach its command-and-control servers, and DNS is a popular way to do it, including DNS tunneling to exfiltrate data. Route 53 DNS Firewall blocks resolution of known malicious domains using managed domain lists AWS keeps current. It’s inexpensive, low-maintenance protection that quietly closes a real gap.
If you run more than one AWS account, configuring each layer by hand doesn’t scale. AWS Firewall Manager enforces your WAF, Network Firewall, DNS Firewall, and security group policies across the whole organization, so a new account inherits your protections on day one instead of becoming the forgotten gap.
You don’t need all of this at once. A defensible baseline for most teams is CloudFront with WAF managed rules in front of public applications, DNS Firewall on your VPCs, and egress rules on Network Firewall where the risk justifies it. The point is to stop treating the network as someone else’s problem. If you want a second opinion on where you’re exposed, we offer a free network security assessment and cover the full architecture in our Network Security on AWS solution.
Migration projects go sideways for predictable reasons. We share the lessons we keep relearning about assessment, sequencing, and the unglamorous basics that actually decide whether a move to AWS holds up.
Learn moreMost cloud overspend doesn't come from one big mistake. It accumulates from idle resources, oversized instances, and forgotten environments. Here's how we look for the slow leaks before they become a surprise bill.
Learn moreA security posture only helps if your team can live with it day to day. We talk about pragmatic baselines, drift detection, and why the controls people quietly work around are the ones that need rethinking.
Learn moreWe're happy to share what we've learned. No pressure, no sales pitch.
Get in touch