waf
8 items across 3 sections
Week 9 - Feb 24 - Mar 2, 2026
Security Hub Extended Plan reaches GA with 14+ partners on day one, the launch most enterprises have been waiting for. LexisNexis loses 2 GB via a misconfigured AWS environment. Three AWS-LC crypto library CVEs land in one drop. VPC Encryption Controls move from preview to paid.
Week 25 - June 15-21, 2026
AWS unveils Continuum, a model-agnostic vulnerability lifecycle platform, and at AWS Summit New York pushes Security Agent into threat modeling and pull-request review. AWS WAF starts charging AI bots for content. On the patch side: Kiro IDE, the AgentCore Python SDK, and five containerd CVEs.
Week 27 - June 29 - July 5, 2026
AWS discloses an HTTP/2 body-inspection bypass in WAF rated CVSS 9.8, and a new CitrixBleed-class NetScaler flaw is exploited within 24 hours of its patch. On the launch side: ACM speaks ACME, GuardDuty watches sensitive file modifications, and WAF extends to AgentCore Gateway. Three more toolchain bulletins land on July 1.
AWS WAF Security Best Practices
Comprehensive guide to securing web applications with AWS WAF. Covers managed rules, Bot Control, Fraud Control (ATP/ACFP), CAPTCHA/Challenge actions, rate-based rules, Shield Advanced integration, and centralized WAF management with Firewall Manager.
Amazon API Gateway Security Best Practices
Comprehensive guide to securing Amazon API Gateway. Covers authentication with Cognito and Lambda authorizers, mutual TLS, WAF integration, resource policies, throttling and usage plans, private APIs with VPC endpoints, access logging, SSL/TLS enforcement, and request validation.
Amazon Cognito Security Best Practices
Comprehensive guide to securing Amazon Cognito user pools and identity pools. Covers MFA enforcement, advanced threat protection, password policies, WAF integration, JWT verification, Lambda trigger security, and identity pool least privilege.
Amazon CloudFront Security Best Practices
Comprehensive guide to securing Amazon CloudFront distributions. Covers Origin Access Control (OAC), TLS 1.3 enforcement, WAF integration, signed URLs and cookies, response headers policies, geo-restriction, VPC origins, field-level encryption, and Shield Advanced DDoS protection.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us