Protect an application in layers

Start with verbs, not product names. Do you need to authenticate a caller, authorize an action, store and rotate a secret, filter a request, absorb a denial-of-service attack, detect suspicious behavior, classify data, or remediate a finding?

One service rarely performs all those jobs. A detector can report suspicious activity without blocking it. A network rule can allow a port without understanding a malicious HTTP request.

Also classify the caller. Employees administering AWS accounts are workforce identities. Software running on AWS is a workload identity. Shoppers signing in to an application are consumer identities.

For every threat, name the preventive control, detective control, and team that responds. This exposes gaps that a long service list hides.

Write one sentence for each threat: who acts, which asset is targeted, and what failure must be prevented or detected. That sentence gives each control a testable job.

Amazon Cognito user pools can manage consumer sign-in and issue application tokens. IAM Identity Center is for workforce access to AWS accounts and applications. Do not create IAM users and long-lived AWS keys for millions of shoppers.

A workload should use its AWS role instead of an embedded access key. The role may retrieve a database credential from Secrets Manager or encrypted configuration from Parameter Store.

Secrets Manager fits when credential lifecycle and rotation matter. Parameter Store SecureString can fit encrypted configuration when native credential rotation is not decisive.

Secret storage does not authorize application behavior. The workload role still needs narrow permission, and the application still decides what its signed-in customer may do.

Rotation needs runtime behavior. The application must fetch or refresh the current value and report failed rotation before the old credential is removed.

Keep application authorization separate from sign-in. A valid customer token proves identity, but the API must still check whether that customer may read or change the requested record.

CloudFront can provide the HTTP edge. AWS WAF can inspect supported HTTP and HTTPS requests, including SQL-injection patterns. Parameterized application code is still required because WAF is not a code fix.

The origin must reject direct callers. If an internet client can call the load balancer without passing through CloudFront and WAF, the edge controls are bypassed.

Shield Standard provides baseline DDoS protection. Shield Advanced adds enhanced capabilities when an explicit need justifies it; neither replaces WAF, identity, secure code, or origin restrictions.

GuardDuty reports suspicious activity, Macie discovers sensitive S3 data, and Inspector finds supported compute vulnerabilities and exposure. These services produce findings; they do not repair workloads.

Assign every finding a triage owner and tested response. Detection without response is only a notification.

Test the bypass explicitly by sending one request to CloudFront and one to the origin address. The protected path should work; the direct path should fail before the application handles it.