Question

A company runs a public-facing web application behind an Application Load Balancer and uses several Elastic IPs for other internet-facing services. They have subscribed to AWS Shield Advanced. During a recent volumetric DDoS attack, the automated mitigations were slower than expected because Shield could not accurately distinguish attack traffic from a legitimate seasonal traffic surge, causing some legitimate requests to be dropped. The networking team wants to improve the accuracy and responsiveness of Shield Advanced automatic mitigations for their protected resources. Which action will BEST achieve this?

Accepted Answer

Associate an Amazon Route 53 health check with each protected resource so Shield Advanced can use health-based detection to tune mitigation sensitivity.

Answer

Enable AWS WAF rate-based rules on the ALB and rely on them as the primary volumetric DDoS mitigation for the protected resources.

Answer

Increase the aggregation interval of VPC Flow Logs so Shield Advanced has more data points to analyze during an attack.

Answer

Move all protected resources behind AWS Global Accelerator and disable Shield Advanced automatic application-layer mitigation.