AWS WAF

A regular firewall looks at addresses and ports: who is connecting, and to which door. A web application firewall (WAF) looks inside the web request itself: the URL, the headers, the form fields. AWS WAF is that filter on AWS. You put it in front of Amazon CloudFront, a load balancer or Amazon API Gateway, and every request is checked against your rules before it reaches your app.

The rules live in a web ACL and can be as simple or as sharp as you need. Block requests that try SQL injection (sneaking database commands into a search box) or cross-site scripting. Limit any single IP address to a certain number of requests per few minutes, which stops crude scrapers and password-guessing bots. Allow only some countries, or block known bad addresses. Each rule says allow, block, or just count, so you can test a rule before enforcing it.

You do not have to write everything yourself: AWS and security vendors publish managed rule groups that cover common attacks and are kept up to date. WAF does not fix bugs in your code, but it buys time, catching the predictable attacks at the door while the real fix is on its way.