How Zillow uses AWS security services to build a secure perimeter
summary
Zillow centralizes WAF via AWS Firewall Manager with tag-based deployment, sending WAF logs through Kinesis Firehose to a centralized S3 bucket and analyzing them with Amazon Athena (UNNEST queries, hourly partition projection) to see which managed rules fire. Two managed rule groups — Anonymous IP and Amazon IP reputation — cut unwanted traffic and improve performance. Teams run rules in count mode, pen-test for false negatives, promote safe rules to block/CAPTCHA, add label-based exceptions and geo rate limits, and use browser and volume checks for stealthy bots.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 1:42WAF architecture and analysis
- 8:02WAF fine-tuning strategies
- 14:17Monitoring and custom rules
- 17:17Custom rule demo
- 24:39Geo-based rate limiting
- 27:52Key lessons learned
- 28:56Advanced bot inspection
- 38:22Getting started and resources
related talks
29mWeb application protection on AWS
33mNetwork and application protection on AWS
18mEnhance application security at the edge with AWS
47mSecure access to AWS with ZTNA 2.0
51mProtect your internet-facing web applications hosted on AWS
15mLevel up security: Advanced AWS WAF rules & bot detection techniques
27mSecuring Applications and Managing WAFs at a large scale
50mAWS Well-Architected for network security