AWS WAF vs Shield vs GuardDuty for the Exam

AWS WAF, AWS Shield and Amazon GuardDuty all sound like "the security one", and both AWS exams name them. The Cloud Practitioner exam (CLF-C02) lists all three under its Security and Compliance domain. The Solutions Architect – Associate exam (SAA-C03) lists WAF and Shield as services for securing applications, and GuardDuty among security services with appropriate use cases. Questions often put two of them side by side.

The way to keep them apart is to ask what each one acts on, and whether it stops anything or only tells you about it.

The short version

If a question says "inspect requests", "SQL injection", "block a country" or "rate limit", think WAF. If it says "DDoS", think Shield, and then decide between Standard and Advanced. If it says "detect", "compromised credentials", "cryptomining" or "unusual API calls", think GuardDuty.

AWS WAF: rules for web requests

AWS WAF lets you monitor and control the HTTP(S) requests that reach your web application. You write the rules in a web ACL and associate it with the resources you want to protect, such as:

• an Amazon CloudFront distribution
• an Application Load Balancer
• an Amazon API Gateway REST API
• an AWS AppSync GraphQL API or an Amazon Cognito user pool

A Network Load Balancer and a plain EC2 instance aren't on that list, and exam questions use that. If the architecture has only an NLB in front of the app, "attach AWS WAF to the NLB" is a wrong answer.

The rules come in a few types worth recognising:

• Managed rule groups: ready-made rules that AWS and AWS Marketplace sellers maintain. Most AWS Managed Rules groups cost nothing beyond the basic WAF charges; a few, such as Bot Control and the fraud-prevention groups, have extra fees.
• SQL injection and XSS match statements: inspect parts of a request for malicious SQL code or scripts. (If cross-site scripting is new to you, see XSS, CSRF and CSP explained.)
• Geo match statements: allow or block requests by the country or region they come from.
• Rate-based rules: count requests and rate-limit a client sending them too fast. This is WAF's answer to HTTP request floods.

Each rule has an action. Allow and Block are terminating: evaluation stops there. Count is not. WAF counts the match and carries on with the remaining rules. That makes Count the answer to "test a new rule on real traffic without blocking anyone". CAPTCHA and Challenge actions check that a request comes from a human or a real browser. Requests that match no terminating rule get the web ACL's default action.

AWS Shield: DDoS protection, in two tiers

AWS Shield protects the perimeter of your application, the first point where traffic from outside AWS enters it. It comes in two tiers, and exam questions usually turn on which one.

Shield Standard is automatic for every AWS customer, at no additional charge. It defends against the most common network and transport layer DDoS attacks. You don't turn it on. AWS notes that you get particular benefit when traffic first arrives through Amazon CloudFront, Route 53 hosted zones or AWS Global Accelerator, because those start at the edge of the AWS network.

Shield Advanced is a paid subscription for higher levels of protection. It protects only the resources you explicitly add, such as CloudFront distributions, Route 53 hosted zones, Global Accelerator accelerators, Application and Classic Load Balancers, and Elastic IP addresses. EC2 instances and Network Load Balancers are protected through their Elastic IP addresses. On top of Standard it adds:

• health-based detection, using health checks, for faster and more accurate detection
• protection groups, to treat several resources as one for detection and mitigation
• detailed real-time metrics and reports on events and attacks
• standard AWS WAF use included for the resources it protects
• access to the AWS Shield Response Team, which also depends on your AWS Support plan

So "the company wants DDoS protection with no extra cost or setup" is Shield Standard. "The company needs detailed attack visibility and help from AWS during an attack on its NLB" points to Shield Advanced, protecting the NLB's Elastic IP addresses.

Shield focuses on network and transport layer attacks. A flood of valid-looking HTTP requests is an application layer attack. The usual answer there is AWS WAF rate-based rules, often in front of CloudFront, or the two together.

Amazon GuardDuty: detection, not prevention

Amazon GuardDuty continuously analyses data from your AWS account. It uses threat intelligence (lists of known malicious IP addresses and domains, file hashes) and machine learning to find suspicious activity. Its findings include compromised AWS credentials, cryptomining on EC2 instances and containers, and malware.

Three details come up in exam questions:

• No setup of the sources. Once enabled, GuardDuty reads its foundational sources (CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS query logs) on its own. You don't need to turn on VPC Flow Logs for it.
• It reports; it doesn't block. GuardDuty sends its findings to Amazon EventBridge. To act on one, you add an EventBridge rule that triggers, for example, a Lambda function that isolates an instance or disables a key.
• Malware Protection for S3 scans newly uploaded objects in the buckets you choose.

In a multi-account setup, a delegated administrator account can enable and manage GuardDuty for every member account in AWS Organizations, including new accounts as they join.

Where the neighbours fit

Exam options often mix these three with similar names. Each of the others has one job:

• Amazon Inspector scans EC2 instances, container images in ECR and Lambda functions for software vulnerabilities and unintended network exposure. Known weaknesses in what you run.
• Amazon Macie finds sensitive data, such as personal information, in Amazon S3. What's in your data.
• Amazon Detective helps investigate a finding and find its root cause. Why it happened.
• AWS Security Hub CSPM checks your environment against security standards and best practices, and gathers findings from GuardDuty, Inspector, Macie and others in one place. The overall view.
• AWS Firewall Manager manages WAF rules, Shield Advanced, security groups and other firewalls across many accounts.
• AWS Network Firewall is a stateful firewall for traffic in and out of your VPC, not for HTTP requests to one application. Security groups and network ACLs, the VPC's own controls, are covered in AWS VPC networking basics.

Three more services sit close to security questions without being "security tools" in the same sense:

• AWS Organizations: service control policies (SCPs) set the maximum permissions for accounts in the organization. An SCP never grants permissions, and SCPs don't affect the management account.
• AWS Backup: central backup plans across services. Vault Lock helps protect backups from being deleted or changed, and copies can go to another Region or account. Ransomware and compliance scenarios often point here.
• AWS VPN: Site-to-Site VPN for an encrypted link between your network and your VPCs, and Client VPN for individual users.

Practice: which service fits?

Try these before reading the answers.

1. An application behind an Application Load Balancer must reject requests from one country. → AWS WAF, with a geo match rule in a web ACL on the ALB.
2. The security team wants to know if any EC2 instance contacts known cryptomining domains. → Amazon GuardDuty. It reads the DNS query logs without extra setup.
3. A team wants to try a new WAF rule on live traffic without blocking anyone. → Set the rule's action to Count, check the counts, then switch it to Block.
4. A small company wants basic DDoS protection with no extra cost. → Shield Standard. It's already on.
5. A GuardDuty finding should automatically stop the affected instance. → An EventBridge rule on GuardDuty findings that invokes a Lambda function. GuardDuty alone only reports.

Practise with AWS Certification Prep

WAF, Shield and GuardDuty each have their own lessons and practice questions in the free AWS Certification Prep, along with Organizations, Backup and AWS VPN. GuardDuty's lessons include a comparison of the security-findings services above, and each lesson cites the AWS documentation it relies on. Its timed assessments can also focus on one exam domain, such as CLF-C02's Security and Compliance or SAA-C03's design of secure architectures.

The same "two names that sound alike" problem runs through the rest of the exam: queues and topics, security groups and NACLs, Multi-AZ and read replicas. Confusing AWS service pairs for SAA-C03 covers those.

Frequently asked questions

Is AWS Shield free?

Shield Standard is. It protects every AWS customer automatically at no additional charge. Shield Advanced is a paid subscription that you turn on for specific resources.

Can GuardDuty block an attack?

No. GuardDuty detects threats and reports them as findings. To respond automatically, send its findings through Amazon EventBridge to something that acts, such as a Lambda function, or use other services to block traffic.

Does AWS WAF protect against DDoS attacks?

Against application layer floods of HTTP requests, yes: rate-based rules limit clients that send too many requests. Network and transport layer DDoS attacks are Shield's job. Many architectures use both, with a WAF web ACL and Shield protecting the same CloudFront distribution.

Can I attach AWS WAF to a Network Load Balancer?

No. WAF works with resources such as CloudFront, Application Load Balancers, API Gateway REST APIs, AppSync and Cognito user pools. To filter web requests for an app behind an NLB, put CloudFront or an ALB in front with a web ACL. For DDoS protection on the NLB itself, Shield Advanced can protect its Elastic IP addresses.

Which of these do I need for CLF-C02 and which for SAA-C03?

Both exam guides name all three. CLF-C02 asks what each service is for. SAA-C03 asks you to fit them into an architecture: where the web ACL goes, which tier of Shield a requirement needs, and how to act on a GuardDuty finding.