A company’s web application runs behind an Application Load Balancer (ALB). The application is under a credential stuffing attack causing many failed login attempts from numerous IP addresses. All malicious requests share the same user-agent string from a known mobile device emulator. The solution must mitigate the attack while allowing legitimate logins. Which approach meets these requirements?

The correct approach is to create an AWS WAF web ACL for the ALB with a custom rule that blocks requests containing the device emulator’s user-agent string. AWS WAF is designed to protect web applications from common web exploits and can filter requests based on various attributes, including user-agent strings. By blocking the specific malicious user-agent, legitimate login attempts from other user-agents will still be allowed, effectively mitigating the credential stuffing attack. Creating a CloudWatch alarm with SNS would only notify about the attack, not mitigate it. Modifying the ALB's security group to deny specific IP addresses is impractical and ineffective against a credential stuffing attack from numerous, potentially changing, IP addresses. Creating a WAF rule to only allow known legitimate user-agent strings is too restrictive and could block legitimate users who are using new or less common user-agent strings.