This module moves from local development to full cloud deployment using Terraform. Learners will build a VPC with public and private subnets, configure security groups, delegate a domain to Route 53, generate SSL certificates with ACM, deploy an Application Load Balancer, and launch EC2 instances in an Auto Scaling group running the Flask container. The module then layers on CloudFront and WAF with logging via Kinesis Firehose. It concludes with a practical analysis of why reactive auto-scaling fails against short, aggressive AI bot spikes, using real commercial data from a Petalbot and Ahrefsbot traffic event.

This module transforms CloudFront into a bot-aware traffic router. Learners will understand the two-layer caching architecture of CloudFront, implement a degraded content strategy that serves lightweight static content to bots while preserving the full experience for humans, and deploy Lambda@Edge to dynamically route bot traffic to a secondary CloudFront distribution backed by S3. The module also addresses cache collision between bot and human responses using CloudFront Functions, solves the missing assets problem through immutable asset deployments and Origin Shield, and concludes with a summary of all key patterns for bot-resilient content delivery.

This module turns the CloudFront edge into an intelligent security gateway. Learners will deploy AWS WAF with IP black and white lists, GEO-based country blocking with whitelist exceptions, and set up Athena to query WAF logs for bot geography analysis. The module progresses through JA4 TLS fingerprinting for advanced rate limiting, granular URL-scoped rate rules, and the AWS IP Reputation List managed rule group. Learners will then enable AWS WAF Bot Control in COMMON mode, examine the labels and categories it emits, integrate the client-side SDK to unlock TARGETED mode, and interpret the Bot Control dashboards. The module culminates in building a Bot Identification Report using Athena and implementing a fully automated three-tier policy (allow, block, degrade) via Lambda@Edge and WAF enforcement rules.