Question

A media company runs a public-facing application behind an Application Load Balancer (ALB) fronted by Amazon CloudFront. The security team subscribes to AWS Shield Advanced and protects both the CloudFront distribution and the ALB. During a recent attack, the team observed a sophisticated HTTP flood consisting of legitimate-looking GET requests to a compute-intensive search endpoint. Shield Advanced's automatic network-layer mitigations did not stop the flood, and application servers were overwhelmed. The team wants Shield Advanced to automatically mitigate this type of attack going forward with minimal manual intervention. What should they implement?

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution and enable Shield Advanced automatic application-layer DDoS mitigation, which creates and manages rate-based WAF rules during detected events.

Answer

Increase the Shield Advanced protection level on the ALB and rely on the AWS Shield Response Team (SRT) to manually deploy network ACL changes during the attack.

Answer

Configure a Network Load Balancer in front of the ALB so Shield Advanced can apply Layer 4 SYN-flood mitigations to the search endpoint traffic.

Answer

Enable AWS Global Accelerator with Shield Advanced so anycast routing absorbs the HTTP flood before it reaches the application servers.