Question

A SysOps administrator is protecting a public-facing application behind an Application Load Balancer. Security testing revealed the application is vulnerable to SQL injection attempts embedded in query strings and request bodies. The team wants to block these attacks with minimal ongoing rule maintenance and without writing custom regex signatures. Which approach best meets these requirements?

Accepted Answer

Associate an AWS WAF web ACL with the ALB and add the AWS Managed Rules SQL database (SQLi) rule group in block mode.

Answer

Enable AWS Shield Advanced on the ALB to inspect and block SQL injection payloads at the application layer.

Answer

Create a custom AWS WAF rate-based rule that blocks any client exceeding 100 requests per five minutes.

Answer

Configure a network ACL on the ALB subnets to deny inbound traffic containing SQL keywords.