Secure Web Applications with AWS WAF

Why it matters

A public GenAI API needs an HTTP traffic protection layer, and AWS WAF is the one 3.1.11 examines.

What to practise

Add a web ACL with a default block action to a deployed API Gateway API. Create rules that count and label, count and deny, and allow through an AND custom rule; control access by IP address and request rate; and block SQL injection with an AWS managed rule set. Send test traffic with Artillery from an EC2 instance, then watch in the WAF metrics and CloudWatch how your rules allowed or denied the requests.

How it fits

For 3.1.11, focus on IP filtering, rate limiting, and the managed rule set as controls that stop hostile traffic before inference. The protected API reads product data from a database, not a model, so the exercise practises the WAF layer, not model content safety.