🛡️ The Edge Security Shield: Automated OWASP Mitigation

---

Mission Objective: Push the application security perimeter to the global edge. This architecture intercepts, inspects, and destroys malicious Layer 7 web traffic (like SQL injections) before it can ever reach the internal Virtual Private Cloud (VPC) infrastructure.

---

🚀 The Core Proof: The Edge Inspection Validation

The primary success metric of this project is the automated destruction of OWASP vulnerabilities. By firing a simulated cyberattack at the infrastructure, we prove the perimeter actively defends the internal application.

🟢 State: Clean Traffic (Standard Request)	🔴 State: Malicious Traffic (SQL Injection)
Action: Accessing the application via the standard CloudFront URL (/?id=1). Result: ✅ Access Granted. Behavior: The request passes WAF inspection, is routed through the ALB, and successfully returns the internal web page with a 200 OK response.	Action: Appending a SQLi payload to the query string (/?id=1' OR '1'='1). Result: ❌ Access Denied. Behavior: AWS WAF instantly recognizes the attack signature, terminates the connection at the edge location, and returns a stark 403 Forbidden error. The internal server never sees the request.

---

🌌 The Concept: "The Fortified Embassy"

Standard deployments place web servers directly on the public internet. This architecture treats the server like a high-value embassy, utilizing defense-in-depth to keep threats miles away from the front door.

🧠 The Embassy Checkpoint Analogy

1. 🛂 The Border Checkpoint (CloudFront): Visitors cannot walk directly up to the embassy. They must stop at a global edge location miles down the road. This massive network absorbs DDoS impacts effortlessly.
2. 🕵️ The Armed Guards (AWS WAF): Highly trained guards inspect every piece of incoming luggage. If they find a weapon on the OWASP watchlist, the visitor is immediately ejected at the border.
3. 🚐 The Secure Shuttle (ALB): If the visitor is clean, they are placed on a secure, dedicated transport vehicle. The internal embassy doors are locked to everyone except this specific shuttle.

---

🏗️ Architecture & Workflow

The Secure Routing Flow: Public Internet ➡️ Amazon CloudFront ➡️ AWS WAF Inspection ➡️ Application Load Balancer ➡️ Private Subnet (EC2)

• Global Edge Absorption: CloudFront masks the true origin IP address while simultaneously accelerating global content delivery.
• Automated Threat Mitigation: AWS WAF utilizes strict managed rule groups to actively block Known Bad Inputs and SQL Database manipulation attempts.
• Zero-Trust Routing: The internal Application Load Balancer is secured via a strict Security Group configuration that exclusively accepts traffic originating from CloudFront Prefix Lists.

---

🛠️ The Technical "Flex": WAF Rule Enforcement

The core of this defense relies on configuring AWS WAF Web ACLs with targeted managed rule groups, transitioning from passive observation ("Count") to active termination ("Block").

WAF Rule Set Configuration Example

{
  "Name": "AWSManagedRulesSQLiRuleSet",
  "Priority": 1,
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AWSManagedRulesSQLiRuleSet"
    }
  },
  "OverrideAction": {
    "None": {} 
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "BlockSQLInjection"
  }
}

---

📝 Key Engineering Insights

• Layer 7 Defense: Successfully engineered an infrastructure perimeter that mitigates OWASP Top 10 vulnerabilities without requiring application code refactoring.
• Traffic Manipulation: Prevented perimeter bypassing by locking the internal Load Balancer to the com.amazonaws.global.cloudfront.origin-facing prefix list.
• ASVS Compliance Alignment: Demonstrated architectural alignment with the Application Security Verification Standard by enforcing strict input validation at the network edge.

---

🎥 Project Walkthrough

Click the image below to watch a live demonstration of the AWS Edge Security Shield in action ⬇️

---

Project by Shreyas
Cloud Security Architect