Skip to content
R&D

AWS Security Services — IAM, WAF, KMS, Shield

The 4 services

Section titled “The 4 services”
Type Mental model
IAM Identity & access Front door keycard — who can do what in AWS (same as GCP IAM)
WAF Web app firewall Content inspector — SQLi, XSS, bots (NOT port control)
KMS Encryption key mgmt Master-key vault — keys that encrypt your DATA
Shield DDoS protection Network flood absorber at AWS edge

Layer map (critical)

Section titled “Layer map (critical)”
L7 Application → WAF, rate limits, code (ReDoS fix), API Gateway throttling
L4 Transport   → NLB, Shield (SYN floods)
L3 Network     → Shield (volumetric floods)


Shield never inspects request CONTENT (regex, SQLi) — network layer only
WAF never controls PORTS — that's Security Groups / NACLs

Attack → service map

Section titled “Attack → service map”
Attack Service
DDoS flood (Gbps) Shield
SYN flood Shield
SQL injection / XSS WAF
Brute force login WAF rate rule (or API GW throttling)
ReDoS (regex attack) ❌ none of these — app code fix + throttling
Port filtering Security Groups / NACLs
Unauthorized AWS access IAM
Data at rest theft KMS

ReDoS is NOT Shield’s job

Section titled “ReDoS is NOT Shield’s job”
  • ReDoS: single attacker sends (a+)+$ regex against "a"*100000+"!" → CPU spin in YOUR app
  • Traffic looks normal at network level — Shield blind to it
  • Fix: safe regex (no nested quantifiers), RE2/timeouts, throttling

The confusions

Section titled “The confusions”
  • KMS vs Secrets Manager: KMS = encryption master keys. Secrets Manager = .env replacement (DB passwords, API keys) — uses KMS underneath. Vaultwarden ≈ Secrets Manager, NOT KMS.
  • WAF vs Shield: WAF = content (L7). Shield = flood (L3/4). WAF rate limit ≠ Shield.
  • Shield vs rate limiter: Shield drops DDoS garbage at edge (millions of IPs, can’t rate-limit). Rate limiter = per-IP count (brute force). DDoS comes from millions of IPs — rate limiting useless against it.
  • IAM vs Cognito: IAM = AWS account users. Cognito = YOUR app’s end users.
  • Shield absorbs = discards: no queue — malicious packets dropped at edge, real traffic passes.

Exam facts

Section titled “Exam facts”
  • IAM = users/groups/roles/policies, least privilege
  • WAF = SQLi/XSS/bots L7
  • KMS = encryption keys (S3/EBS/RDS integrate)
  • Shield Standard = free; Advanced = $3000/mo (DDoS response team, WAF integration)
  • “encrypt data at rest” → KMS
  • “block SQL injection” → WAF
  • “DDoS” → Shield
  • “who can access console” → IAM
Section titled “Related”
  • [[aws/index]]
  • [[aws/management-services/index]]