A company hosts a web application on EC2 and needs to apply custom rules to inspect and control incoming web traffic. Which AWS service provides this capability?

AWS WAF (Web Application Firewall) is the correct choice because it allows you to define custom rules to filter and control HTTP and HTTPS traffic to your web applications. This enables protection against common web exploits and bots that could affect application availability, compromise security, or consume excessive resources. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for custom web traffic rules. Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service, which protects against large-scale attacks but doesn't offer custom rule-based traffic inspection for web applications.