AWS Certified Solutions Architect - Professional (#516)

As a part of building large applications in the AWS Cloud, the Solutions Architect is required to implement perimeter security protection. Applications running on AWS have the following endpoints:

Application Load Balancer

Amazon API Gateway regional endpoint

Elastic IP address-based EC2 instances.

Amazon S3 hosted websites.

Classic Load Balancer

The Solutions Architect must design a solution to protect all of the listed web front ends and provide the following security capabilities:

DDoS protection

SQL injection protection

IP address whitelist/blacklist

HTTP flood protection

Bad bot scraper protection

How should the Solutions Architect design the solution?

Deploy AWS WAF and AWS Shield Advanced on all web endpoints. Add AWS WAF rules to enforce the company’s requirements.
Deploy Amazon CloudFront in front of all the endpoints. The CloudFront distribution provides perimeter protection. Add AWS Lambda-based automation to provide additional security.
Deploy Amazon CloudFront in front of all the endpoints. Deploy AWS WAF and AWS Shield Advanced. Add AWS WAF rules to enforce the company’s requirements. Use AWS Lambda to automate and enhance the security posture.
Secure the endpoints by using network ACLs and security groups and adding rules to enforce the company’s requirements. Use AWS Lambda to automatically update the rules.