A global media streaming platform uses Amazon Route 53 for DNS, Amazon CloudFront for content delivery, and an Application Load Balancer (ALB) backing an Auto Scaling group of Amazon EC2 instances. During peak events, the platform is frequently targeted by HTTP flood attacks (Layer 7) that cause the EC2 Auto Scaling group to scale out unnecessarily, resulting in high costs. Additionally, DNS query floods have recently threatened the availability of their DNS services. The platform requires a solution that automatically mitigates both Layer 7 and DNS-level DDoS attacks, provides real-time visibility into attacks, and offers financial protection against scaling costs incurred due to DDoS-related traffic spikes. Which solution will meet these requirements with the least administrative effort?
- Subscribe to AWS Shield Advanced. Associate Shield Advanced with the Route 53 hosted zones, CloudFront distributions, and the ALB. Enable AWS WAF on the CloudFront distributions, configure rate-based rules, and enable Shield Advanced automatic application-layer DDoS mitigation.Answer
- BSubscribe to AWS Shield Standard. Enable AWS WAF rate-based rules on the Application Load Balancer. Create a custom AWS Lambda function that parses VPC Flow Logs and dynamically updates Network ACLs at the subnet level to block malicious IPs and prevent EC2 scaling costs.
- CSubscribe to AWS Shield Advanced. Associate Shield Advanced with the VPC subnets containing the Application Load Balancer and EC2 instances. Enable AWS WAF on the ALB to mitigate DNS query floods, and configure Security Group rules to block volumetric Layer 4 attacks at the edge.
- DEnable AWS WAF on the Application Load Balancer. Implement AWS Shield Standard across the CloudFront distributions and ALB. Use AWS Firewall Manager to automatically create and deploy stateless Network ACL rules to the VPC boundary to filter out Layer 7 HTTP flood attacks.