M TRAFFIC DEFENCE LAB

AWS DEMO / MOCK MARKETPLACE TRAFFIC

Deployed in AWS.
Tested with mock traffic.

I deployed a mock marketplace in AWS and sent test traffic through it. Here are the controls implemented through code, the WAF decisions, policies in Count mode and rule recommendations.

View the results ↓Run the lab ↗
01Mock trafficBuyer and abuse scenarios
→
02Code controlsSessions, rates and request cost
→
03WAF decisionsRecorded Allow and Block actions
→
04Count policiesEndpoint scopes and thresholds
→
05RecommendationsCompare limits on sample traffic

CONTROLS IMPLEMENTED THROUGH CODE

Application and AWS controls

View the code ↗
Application tests

Two instances share one allowance.

  • Session signatures are validated.
  • Product requests share an endpoint allowance.
  • Search requests consume credits based on query cost.
  • Redis outage tests check browsing and sensitive endpoints.
View application checks
    View application results ↗
    AWS tests

    AWS controls

    • CloudFront and WAF inspect incoming traffic.
    • A private load balancer routes requests to two app instances.
    • Shared Redis tracks request allowances.
    • The WAF test checks blocking and rollback to Count.
    View AWS checks

      WAF RESULTS

      Live WAF decisions and Count policies

      AWS run snapshot

      Live WAF decisions

      Actions recorded during the AWS test run.

      RuleActionRequests

      Snapshot of delivered WAF logs from controlled test traffic.

      Policies in Count mode

      Count records matching traffic for review.

      PolicyLimit / minAction

      Endpoint policies group by source address. JA4 observation groups by fingerprint.

      PYTHON / LABELLED MOCK TRAFFIC

      Rule recommendations

      View recommendation data ↗

      I compare application limits against labelled buyer and abuse scenarios. The results guide endpoint proposals and further WAF observation.

      Loading…

      Sample abuse rejected—
      Sample buyer requests rejected—Lab budget ≤ 1%
      Starting request credits—
      Sample traffic replay Requests per 10-second interval
      Buyer requestsAbuse scenariosRequests rejected by the evaluated limit

      How I chose this limit

      Proposed WAF rule

      I test application limits using saved sample requests. I use WAF Count mode to review matching traffic before turning on blocking.

      Technical settings and test data

      Request credits set the allowance for each session or source address. Larger searches use more credits.

      Normal traffic P99: cost units per rate-limit key per second
      Most different products requested by one session
      Addresses sharing a fingerprint in the sample

      P99 is the 99th percentile: 99% of measured values fall at or below this level.

      CapacityRefill / secSample abuse rejectedBuyer rejection

        DEPLOYED AWS REQUEST FLOW

        WAF at the edge.
        Shared limits in the application.

        I attached WAF to CloudFront. Both application instances use the same Redis allowance for each rate-limit key.

        Controlled test client
        ↓ HTTPS
        CloudFront + AWS WAF
        ↓ private VPC origin
        Internal load balancer → two application tasks
        ↓ TLS
        Private ElastiCache Redis

        Viewer and Redis connections use TLS. CloudFront-to-ALB and ALB-to-application connections use private HTTP.

        POSSIBLE PRODUCTION EXTENSION

        Detect, investigate and deploy new rules.

        I would add Python detections or integrate with a SIEM to flag suspicious patterns. After investigation, I would deploy WAF rules in Count mode and review traffic and buyer impact in a live dashboard. SOAR could coordinate approvals, deployment and rollback.

        View the solution flow ↗