AWS Edge Services
๐ AWS Edge Services Overview
AWS Edge Services deliver content, security, and performance optimization through globally distributed edge locations. This page introduces the key services used in this demo.
Amazon CloudFront
Global Content Delivery Network (CDN) service
Key Features
- Global Distribution: 400+ edge locations worldwide
- Caching: Static and dynamic content caching
- VPC Origin: Connect private-subnet resources
- Functions: Lightweight JavaScript at the edge
Usage in This Demo
- Route bot traffic to the timeout ALB (Demo 1)
- Switch unverified AI bots to fake-page S3 (Demo 3)
- Route
/private/*to fake page S3 - Static asset caching optimization
AWS WAF (Web Application Firewall)
Firewall service that protects web applications
Key Features
- Bot Control: ML-based bot detection (TARGETED)
- Rate Limiting: Per-IP request rate limiting
- Managed Rules: AWS-managed security rule groups
- Label Interpolation: Dynamically inject label values as headers
Usage in This Demo
- Forward bot signals to origin via
x-amzn-waf-*headers - DDoS protection via rate-based rules
- Block common L7 attacks with Core Rule Set
- Block spoofed WAF headers (P0)
Application Load Balancer
Layer 7 load balancer service
Key Features
- HTTP/HTTPS: Application-level routing
- Target Groups: Backend server group management
- Health Checks: Server health monitoring
- VPC Integration: Private ALB as CloudFront VPC Origin
Usage in This Demo
- Normal traffic ALB (alb-origin)
- Timeout ALB for bots โ no targets, 30s read timeout
- Integrated with Auto Scaling Group
๐ Multi-Layer Security Architecture
1. DDoS Protection
Network and transport layer DDoS protection via AWS Shield and CloudFront
2. Application Layer Attacks
Block SQL Injection, XSS, and other L7 attacks via AWS WAF Core Rule Set
3. Bot Detection & Deception
AWS WAF Bot Control detects โ CloudFront Function and origin apply deception. Deception over blocking is the core principle.
๐ค Bot Defense Strategy Comparison
Block
Completely block malicious bots.
Pros
- Reliable protection
- Resource savings
Cons
- Bots detect block and adapt
- False positive risk
Challenge
Distinguish bots via CAPTCHA or JavaScript challenge.
Pros
- Accurate classification
- Considers UX
Cons
- User friction
- Advanced bots can bypass
Count (Monitor)
Record and analyze bot activity to identify patterns.
Pros
- Data collection
- Pattern analysis
Cons
- No immediate protection
- Resource consumption
Deception โ This Demo
Feed bots false information or waste their resources โ without ever signaling detection.
Pros
- Bot activity delayed and wasted
- Prevents bot adaptation
- Poisons collected data
Cons
- Implementation complexity
- Ongoing maintenance
๐๏ธ This Demo's Architecture
Request
Browser / Bot
CloudFront
Edge reception
AWS WAF
Bot detect + headers
CF Function
Deception routing
ALB / S3
Normal or fake origin
EC2
Node.js app (normal path)
๐ฐ Cost Optimization
CloudFront Caching
Cache static assets at the edge to reduce origin load
WAF Scope-Down
Exclude static assets from Bot Control inspection to minimize TARGETED billing
Auto Scaling
Automatic scaling based on traffic to optimize EC2 costs