One-line conclusion
- AWS WAF filters Layer 7 HTTP(S) requests.
- AWS Shield mitigates DoS and DDoS.
- Security groups control network connections to resources or ENIs.
Core differences
| Dimension | AWS WAF | AWS Shield | Security group |
|---|---|---|---|
| Protected target | Web applications | Public applications and AWS edge entry points | EC2, ENIs, ALBs, and other resources |
| Focus | Headers, URI, IP, SQL injection, XSS | Traffic floods and DDoS | Protocol, port, source, and destination |
| Layer | Application layer | Network and edge DDoS protection | Stateful resource-level network control |
| Typical integrations | CloudFront, ALB, API Gateway | CloudFront, Route 53, ELB | Resources inside a VPC |
Scenario shortcut
Choose WAF for web attack rules, Shield for DoS or DDoS, and security groups for protocol, port, and source control.