Network & AppSec
AppSec and Network Controls Without Slowing Releases.
What this hub covers
WAF managed rules and a default VPC are not enough for any serious production workload. The guides below cover layer-7 defenses, API-specific rate limiting and bot protection, AWS Verified Access for AWS-native ZTNA (replacing legacy VPN for workforce app access with IAM Identity Center / OIDC trust providers and Cedar policy), AWS Network Firewall plus Firewall Manager for stateful L3-L7 inspection at multi-account scale, and VPC patterns that hold up under real traffic and regulatory scope.
5 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
AWS WAF: Web Application Firewall Configuration for Production
AWS WAF blocks attacks. It also blocks legitimate users when the rules are wrong, which is a worse incident. Managed rule groups, custom rules, rate limiting, bot control, and the layered defense strategy that protects without flooding your support queue.
Read the guideHow to Configure AWS WAF for API Protection (Beyond the Basics)
WAF beyond “enable managed rules”: COUNT→BLOCK, rate limits, Bot Control cost traps, GraphQL depth. July 2026 API protection checklist.
Read the guideAWS VPC Networking Best Practices for Production
A VPC misdesign at month two becomes a multi-quarter migration at year two. CIDR planning, subnet strategies, NAT gateways, VPC endpoints, Transit Gateway, and the network architecture patterns that scale without forcing a re-IP.
Read the guideAWS Verified Access in Production: A Zero-Trust Network Access (ZTNA) Replacement for Legacy VPN
Verified Access ZTNA: Cedar policies, Identity Center, TCP endpoints (GA). July 2026 Client VPN migration checklist.
Read the guideAWS Network Firewall + Firewall Manager: Multi-Account Stateful L3-L7 Defense in Production
Network Firewall + Firewall Manager for Org-wide L3 to L7. July 2026: centralized inspection, Suricata, TLS bypass, rollout checklist.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
AWS Security Consulting
AWS security consulting from an AWS Select Tier Partner. 2-week assessment, 4–6 week remediation, zero disruption. IAM hardening, public exposure, compliance gaps, and continuous monitoring.
Explore the serviceAWS Penetration Testing Services
AWS-aware penetration testing — IAM privilege escalation, S3 misconfiguration, instance metadata exploitation, web app and API testing. OSCP-certified testers, OWASP/PTES methodology, AWS-compliant scope.
Explore the serviceThreat Detection & Response
Continuous monitoring, Security Hub AI inventory, agentless vulnerability scanning, OCSF data lakes, and automated remediation.
Open the hubIAM & Access Control
Least-privilege patterns, workforce SSO with identity propagation, customer auth, and fine-grained Cedar-policy authorization.
Open the hubGovernance & Multi-Account
Multi-account is where compliance scope is either won or quietly lost. Control Tower, landing-zone topology, automated conformance packs, and drift detection — the patterns that hold scope at 50+ accounts.
Open the hubCommon questions
- Is AWS WAF enough, or do we also need AWS Network Firewall?
- They protect different layers and traffic shapes. WAF inspects HTTP/HTTPS traffic at the application layer (CloudFront, ALB, API Gateway, AppSync, Cognito, Verified Access) and is the right tool for SQL injection, XSS, bot mitigation, OWASP-pattern blocking, rate limiting, and geographic blocking. Network Firewall is a stateful network-layer (L3-L7) firewall for VPCs — it inspects all traffic in and out of a VPC (TLS-inspection optional), runs Suricata-compatible IDS/IPS rules, and enforces domain-based egress filtering. Most regulated workloads run both: WAF in front of the public application, Network Firewall on the VPC edge for east-west and egress control. Firewall Manager pushes a single Network Firewall policy across every account in your AWS Organization.
- When should we replace VPN with AWS Verified Access?
- Verified Access is the right call for workforce access to internal HTTPS (and now TCP) applications — Jenkins, internal dashboards, ArgoCD, Grafana, internal SaaS clones — where the legacy AWS Client VPN gives the user a flat network that is hard to scope. With Verified Access, each application has its own endpoint, trust providers (IAM Identity Center, generic OIDC, or device posture from Jamf / CrowdStrike / Jumpcloud), and a Cedar policy that decides per-request whether to allow access. There is no client to install for HTTP apps. Keep Client VPN only for legacy use cases that need raw TCP/UDP at scale to broad subnets (finance/healthcare back-office tools, RDP fleets) — and even then, plan the Verified Access migration as those legacy apps go web-first.
- How does AWS Firewall Manager fit alongside Control Tower?
- Firewall Manager is the multi-account policy engine; Control Tower is the multi-account landing zone. They are complementary. Once Control Tower has provisioned your accounts and OUs, Firewall Manager pushes WAF rule groups, Network Firewall stateful policies, Shield Advanced protections, security-group baselines, and DNS Firewall policies as Organization-level policies. New accounts inherit the policies on creation; drift (a manually-edited security group, a missing WAF rule) is auto-remediated or flagged based on the policy mode. Without Firewall Manager you end up writing per-account Terraform — workable for 5 accounts, painful at 50, broken at 200.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}