A public API runs as Amazon ECS tasks on AWS Fargate behind an Application Load Balancer (ALB). Service Auto Scaling scales tasks based on CPU. Recently, a surge of SQL injection attacks caused the service to scale to its maximum and the API became unusable. The architect must stop SQL injection attacks from reaching the ECS service, allow legitimate traffic, and maximize operational efficiency. Which solution meets these requirements?

The correct solution uses AWS WAF with a SQL database rule group to specifically block SQL injection attempts. Attaching this Web ACL to the ALB ensures that malicious traffic is filtered before reaching the ECS tasks, preventing resource exhaustion and maintaining API availability. The rule to allow all other traffic ensures legitimate requests pass through. Incorrect options: Simply creating a new AWS WAF web ACL without specific rules for SQL injection does not address the problem. AWS WAF Bot Control is designed to manage bot traffic, not specifically SQL injection attacks, which are a type of application-layer attack. While it might offer some general protection, it's not the most direct or efficient solution for this specific threat. Using an IP set and a Lambda function to dynamically block IPs is reactive and less efficient. SQL injection attacks often originate from various IPs, and this approach would block IPs only after an attack has been detected, potentially allowing initial attacks to succeed and requiring continuous management.