AWS WAF

WAF rules attach to CloudFront, the single entry point every request already passes through in a reverse-proxy setup. That makes it the natural place to catch OWASP Top 10 style attacks before they reach application code, one attachment point instead of one per service.

Pricing gotcha

Most of the services in a serverless design bill purely for usage. Some WAF managed rule groups don't, they charge a flat fee regardless of traffic. Don't assume the whole stack behaves the same way on cost; check each service's pricing model individually.

Where this showed up

• The frontend that never touches a password: WAF as part of CloudFront's security role.
• Grading the registration architecture: the flat-fee pricing exception.

Further Reading and Watching

• Docs: AWS WAF, how it works (AWS docs)