Layered security for a static site

Comments

• WAF attaches to CloudFront through a Web ACL. Rules are evaluated by priority; the dashed line represents that association.
• Shield Standard is enabled at no extra cost and protects against layer 3 and 4 attacks. Shield Advanced is a paid service with extended protection and support.
• KMS encrypts objects at rest. The dashed line shows that S3 uses the key; user traffic does not pass through KMS.
• Route 53 should point to CloudFront with an alias record, never directly to the S3 bucket.

Information flow

1. Amazon Route 53

   The user resolves the domain; Route 53 answers with an alias to CloudFront.

2. AWS WAF and AWS Shield

   Before serving the request, WAF evaluates managed rules (OWASP), bot control and rate limits. Shield absorbs volumetric DDoS traffic.

3. Amazon CloudFront + OAC

   If the request passes the filters, CloudFront serves it from cache or fetches the object from S3 through OAC.

4. Amazon S3 + AWS KMS

   The bucket is private. Objects are encrypted with a KMS key, which S3 uses when storing and serving them.