0

I'm running a company web application in AWS. This web app is behind a cognito+External Identity provider with SAML for only allowing company employees to reach the app (then they log in with local credentials to the app, as it is not possible to use SAML).

In this context, does it make sense to put a WAF? A potential attacker could not launch attacks if he is not authenticated (unless also valid credentials were stolen).

Note aside: When I say WAF, I'm talking about AWS standard WAF (not shield). I'm concerned about DDoS attacks mostly, because AWS standard WAF only covers layer 3/4 attacks not layer 7 (unless you pay Shield, which is above the budget.)

Improve this question
5
  • 3
    I don't understand your question. You say you are mostly worried about DDoS attacks, then say that the thing you are skeptical about would exactly solve your problem. What is your actual question?
    – user163495
    Apr 20, 2020 at 14:08
  • Thanks for your comments. Just to clarify a little bit @MechMK1. - Moving aside my specific question about ddos, does it make sense to have a waf when you are using cognito+External Identity provider? The only attack that I can think of without having compromise a company account is dos or ddos. - Is there any way to add layer 7 protection against ddos withouth paying for AWS shield advanced? let me know if I have to edit the post itself with this information
    – FaridHazan
    Apr 20, 2020 at 15:56
  • I don't have personal experience with cognito, so it's hard to tell for me. But in general, many businesses use a WAF as a defense-in-depth approach
    – user163495
    Apr 20, 2020 at 17:35
  • @FaridHazan, just because an app is protected by auth doesn't mean it's "secure". It could still be vulnerable to SQLi/XSS/etc.
    – phbits
    Apr 20, 2020 at 21:32
  • standard WAF only covers layer 3/4 attacks How is it called a web application firewall WAF? Web applications live on the application layer.
    – Esa Jokinen
    Apr 24, 2020 at 22:04

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .