In the previous article, I built an application detects → edge blocks feedback loop. However, I did not cover the most important part: how the application should actually detect malicious behavior.
Without that piece, many readers may still be wondering what a practical implementation looks like. So, in this final article in the series, I will walk through what to log, which queries to run, how to combine the results into a risk score, and how to register the resulting fingerprints in Amazon CloudFront KeyValueStore (KVS), including code examples.
The basic rule is that a single signal should never result in an immediate ban. Blocking on one indicator alone often produces false positives. Instead, we will add together multiple weighted signals and choose between challenge and block according to the total score.
The analysis stack in this article is Amazon CloudWatch Logs and CloudWatch Logs Insights.
Previous articles in this series
