A company wants to monitor and block malicious HTTP and HTTPS requests that its Amazon CloudFront distributions receive. Which AWS service should the company use to meet these requirements?

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads, but it does not block specific HTTP/HTTPS requests at the application layer.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS by identifying vulnerabilities, not blocking HTTP/HTTPS requests.

AWS WAF (Web Application Firewall) allows users to create custom rules to filter and block malicious HTTP and HTTPS requests targeting web applications, including those served by Amazon CloudFront. It specifically protects against common web exploits such as SQL injection and cross-site scripting.

Amazon Detective is a security service that investigates the root cause of security findings or suspicious activities and helps analyze, investigate, and identify the root cause of security issues, not block requests in real-time.