Question

A financial services company runs a public-facing API behind an Application Load Balancer protected by AWS WAF. Following the disclosure of a critical remote-code-execution vulnerability (Log4Shell), the security team must immediately block exploit attempts against the API while ensuring legitimate traffic is unaffected and the protection stays current as AWS updates its detection signatures. The team wants the lowest-operational-overhead solution. Which action best meets these requirements?

Accepted Answer

Add the AWS Managed Rules 'AWSManagedRulesKnownBadInputsRuleSet' to the web ACL in block mode, which includes rules that inspect for Log4j/JNDI exploit patterns and is automatically maintained by AWS.

Answer

Create custom WAF regex pattern set rules matching known JNDI strings and manually update them each time a new exploit variant is published.

Answer

Attach a rate-based rule set to a low threshold so that any client sending JNDI-style requests is throttled before reaching the API.

Answer

Enable AWS Shield Advanced on the ALB and rely on the DDoS Response Team to filter the Log4j exploit traffic at the edge.