This project implements a cloud-native, real-time SQL Injection (SQLi) detection and alerting pipeline using AWS managed services.
It replicates enterprise-grade monitoring and security practices for applications backed by relational databases.
The system analyzes SQL queries executed on Amazon RDS, identifies anomalous or malicious patterns, and triggers alerts via Amazon SNS.
Edge-level request filtering is applied through Amazon CloudFront integrated with AWS WAF.
SQL Injection remains one of the most persistent and high-impact vulnerabilities in modern web applications.
Traditional WAF filtering does not provide backend visibility into SQL queries that reach the database.
This project addresses these gaps by:
- Providing post-execution SQL visibility
- Combining WAF filtering with backend SQL analysis
- Implementing real-time detection
- Demonstrating a production-style cloud security pipeline
OWASP Juice Shop is used as the intentionally vulnerable application to safely generate SQLi patterns for testing.
- CloudFront + WAF provide edge protection
- ECS hosts the application workload
- RDS executes and logs SQL queries
- CloudWatch streams logs
- Lambda performs detection
- SNS delivers security alerts
- Global CDN entry point
- Reduces latency and isolates backend infrastructure
- Origin for WAF WebACL attachment
- Ensures attackers cannot directly access ALB/ECS
- Attached to CloudFront distribution (Global Scope)
- Applies AWS-managed SQLi and bad-input rule sets
- Filters malicious payloads before reaching application
- Routes sanitized traffic to ECS tasks
- Performs health checks
- Forms core of the application access layer
- Runs the OWASP Juice Shop container
- Communicates with RDS for SQL operations
- Enables real-world SQL injection testing
- Primary data store for the application
- Generates SQL query logs (General Log)
- Integrated with CloudWatch for log export
- Stores RDS SQL logs
- Forwards logs to Lambda via Subscription Filter
Responsibilities include:
- Parsing SQL logs
- Rule-based SQLi detection
- Anomaly scoring using entropy
- Severity evaluation
- Publishing alerts via SNS
- Updating WAF IP Sets (optional)
- Distributes real-time alerts containing SQL query data
- Includes detection rationale and severity score
Detects:
- UNION SELECT
- Boolean SQLi (1=1)
- SQL comments (--, /* */)
- information_schema access
- long or abnormal queries
Evaluates:
- token diversity
- pattern clustering
- structural irregularities
Alerts triggered when: final_score ≥ 3
Specified in Lambda/sql-detector.py
Test SQL injection payloads:
?q=' OR 1=1 --
?q=UNION SELECT email, password FROM users --
?q=' UNION SELECT * FROM information_schema.tables --
Expected behavior:
- CloudFront/WAF may block
- If passed, RDS logs the query
- CloudWatch triggers Lambda
- SNS sends an alert
OWASP Juice Shop: https://owasp.org/www-project-juice-shop/
Used for safe SQL injection testing and demonstration.
The CloudFront-hosted version (https://d3c8rnxucib2vp.cloudfront.net) is secured behind WAF and this detection pipeline.