A digital publishing company hosts a subscription-based platform on AWS. The static frontend is stored in an Amazon S3 bucket, and the dynamic subscription API runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During a high-profile release, the platform suffers from a Layer 7 HTTP flood attack targeting the login API endpoint, causing database connection exhaustion. Concurrently, the infrastructure experiences a Layer 4 SYN flood attack that threatens to saturate the internet bandwidth. The company needs to block the application-layer attack, mitigate infrastructure-layer attacks at the network edge, and secure financial protection against EC2 auto-scaling charges incurred during DDoS attacks. Which combination of actions will meet these requirements with the least operational overhead?
- ADeploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Standard on the distribution, and configure AWS WAF on the ALB with custom rate-limiting rules to block the Layer 7 flood and claim automatic credit refunds for resource scaling.
- BConfigure stateless Network Access Control Lists (NACLs) at the VPC boundary to drop traffic from the attacking IP addresses. Enable AWS Shield Advanced on the backend EC2 instances to mitigate the Layer 7 HTTP flood and provide scaling cost protection.
- Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Advanced on the CloudFront distribution and associate an AWS WAF web ACL with a rate-based rule targeting the login endpoint.Answer
- DAssociate an AWS WAF web ACL directly with the ALB to mitigate the Layer 7 attack. Rely on AWS Shield Standard at the ALB to automatically block the Layer 4 SYN flood, and configure AWS Budgets to automatically shut down EC2 instances to prevent scaling charges.