AWS Shield Standard: Automatic protection against SYN floods, UDP reflection, and other L3/L4 attacks on all AWS resources.

CloudFront CDN: The global edge network absorbs volumetric attacks before they reach the origin server.

WAF rate limiting: 100 requests per 5 minutes per IP on public and analytics endpoints, configured at both WAF layers (CDN and load balancer).

Brute-force protection: Maximum 5 authentication attempts per user ID and IP, with automatic lockout and user notification. Suspicious IPs are automatically throttled.

Geo-blocking: Unauthorized countries are blocked at both WAF layers (CDN and load balancer).

IP reputation: Known malicious IP addresses are automatically blocked via managed rule lists.