How to Rate-Limit DDoS Protection for a CloudFront-Hosted S3 Website?

SOA-C03 By islever Editorial Last updated

Implement strategies to protect data and infrastructure. Configure domains, DNS services, and content delivery.

Short answer

A Deploy a global-scoped AWS WAF web ACL with allow default action and a rate-based block rule, then associate it with the CloudFront distribution.

Question

A company's public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A CloudOps engineer needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied.
Which solution will meet these requirements?
  1. Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution. Correct Answer
  2. Deploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
  3. Deploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
  4. Deploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.

Key Takeaways

The exam tests WAF scope and rule action semantics for CloudFront, and the trap is assuming an S3 bucket can be directly associated with a WAF web ACL or that a block-by-default web ACL should be used.

This question tests how to apply AWS WAF rate-based rules through CloudFront to control DDoS throttling for an S3-backed public website. The correct design uses a global-scoped web ACL with an allow default action and a blocking rate-based rule attached to the CloudFront distribution.

Common mistake: Choosing B or D because they place the web ACL in us-east-1 and try to associate it with the S3 bucket; AWS WAF web ACLs for CloudFront are global and cannot be attached directly to an S3 bucket.

Expert Analysis

Why the Answer Is Correct

Option A matches the AWS WAF deployment pattern for a CloudFront-fronted website: the web ACL must be global-scoped and associated with the CloudFront distribution, which is the public entry point where DDoS traffic is absorbed. An allow default action lets normal visitors through, while the rate-based rule blocks only sources that exceed the configured request rate. This directly satisfies the requirement to maintain control over the rate limit at which DDoS protections are applied. It also correctly avoids treating the S3 origin as the WAF enforcement point.

Why the Other Options Are Wrong

Option B is wrong because it tries to associate the AWS WAF web ACL with the S3 bucket; AWS WAF protects supported entry points such as CloudFront distributions, not S3 buckets directly. Option C inverts the intended logic by using a block default action and a rate-based allow rule, which would block normal users unless they were explicitly allowed by rate. Option D repeats both errors: it uses block-by-default with rate-based allow and attempts an invalid S3 bucket association. Only option A combines the correct global scope, correct default action, correct rate-based block behavior, and correct CloudFront association.

Community Comment Notes

As Bad_Mat noted, the correct approach is to "Deploy a global-scoped AWS WAF web ACL" with an allow default action and a rate-based block rule, then associate that web ACL with the CloudFront distribution. This aligns with the AWS WAF model for CloudFront protection and with the requirement to control the DDoS rate-limit threshold. The comment also correctly rejects associating the web ACL with the S3 bucket.

Official Reference

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When CloudFront is the public entry point, choose the WAF scope and association that match the distribution, not the origin bucket. For rate limiting, default allow plus a blocking rate-based rule preserves normal traffic; block-by-default with rate-based allow only makes sense for narrow allowlists.

Frequently Asked Questions

Why can't the AWS WAF web ACL be associated directly with the S3 bucket?

AWS WAF protects supported entry points such as CloudFront distributions and load balancers; an S3 bucket is not a direct WAF association target, so the web ACL must attach to CloudFront.

What scope should an AWS WAF web ACL use for CloudFront?

A web ACL associated with CloudFront is global-scoped, even though the console and API resources are created in us-east-1.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Bad_Mat 👍 1 Answered A
    The correct solution is A. Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide