Protecting the Edge

The first hit lands here: choosing edge controls from the threat you actually expect, CloudFront as a security boundary with Origin Access Control and signed URLs, WAF web ACLs engineered rule by rule with priority and labels, and Shield Standard versus Shield Advanced for DDoS resilience.

Content current as of 2026-10.

Lessons

1. Choosing an edge strategy
2. CloudFront as a security boundary
3. Engineering WAF rules
4. Shield and DDoS resilience

Sources

• SCS-C03 exam guide — Content Domain 3 (tasks 3.1–3.3)
• Serving private content with signed URLs and signed cookies (CloudFront)
• Restricting access to an Amazon S3 origin (Origin Access Control)
• How AWS WAF works — web ACLs, rules, and rule groups
• AWS Shield Advanced — AWS WAF, Shield, and Firewall Manager developer guide