> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/infrastructure-security-70/protect-a-web-tier-in-a-public-subnet.md).

# Protect a Web Tier in a Public Subnet

* **WAF** gives you **control over how traffic reaches your applications** by enabling you to **create security rules that block common attack patterns, such as SQL injection or cross-site scripting**, and rules that filter out specific traffic patterns you define.

* **WAF is tightly integrated with CloudFront and the ALB**, services that AWS customers commonly use to deliver content for their websites and applications.

* **When you use WAF on CloudFront, your rules run in all AWS Edge Locations, located around the world close to your end-users**.

* **Blocked requests are stopped before they reach your web servers**.

* **When you use WAF on an ALB, your rules run in region and can be used to protect internet-facing as well as internal load balancers**.

* If the **web servers are hosted in public subnets behind a public-facing ALB while the application servers are hosted in private subnets**, you can **migrate your servers to private subnets** and then **remove any attached public IP or Elastic IP addresses**.

* The **public-facing ALB can route the traffic to these web servers hosted in private subnets**.<br>

* So, to **protect a Web Tier in a Public Subnet:**
  * **Migrate the web servers to private subnets without any public IP or Elastic IP addresses.**
  * **Integrate WAF to the ALB to provide SQL injection or cross-site scripting attack protection to the online application.**
  * **Launch a new CloudFront distribution and configure it to use WAF.**