Question

A company runs a public-facing application behind an Application Load Balancer in a production account. During a recent volumetric DDoS event, on-call engineers struggled to respond and wanted AWS to proactively engage on their behalf. The security team also wants cost protection against DDoS-related scaling charges and the ability to have AWS experts apply mitigations to their ALB and Route 53 resources during future attacks. Which combination of actions BEST meets these requirements?

Accepted Answer

Subscribe to AWS Shield Advanced, associate the protected resources, and configure the Shield Response Team (SRT) with an IAM role and engagement so they can act during attacks; enable cost protection through Shield Advanced.

Answer

Rely on AWS Shield Standard, which is automatically enabled, and open a support case with the SRT when an attack occurs to receive cost credits and mitigation assistance.

Answer

Deploy AWS Network Firewall in front of the ALB with a stateful rule group that rate-limits inbound connections, and enable AWS Config to alert on rule changes.

Answer

Enable AWS WAF rate-based rules on the ALB and create an Amazon GuardDuty threat list so that GuardDuty automatically blocks attacking IPs at the edge.