Question

A retail company runs a public API behind an Application Load Balancer. During flash sales, a small number of client IP addresses generate bursts of legitimate-looking HTTP GET requests that overwhelm backend targets, causing 5xx errors for all users. Standard signature-based rules do not match the requests because they are well-formed. The security team wants an AWS-native, managed control that automatically blocks individual source IPs that exceed a request threshold over a rolling time window, while leaving other clients unaffected. Which solution best meets this requirement?

Accepted Answer

Associate an AWS WAF web ACL with the ALB and add a rate-based rule that counts requests per originating IP over a 5-minute window, blocking IPs that exceed the configured limit.

Answer

Enable AWS Shield Advanced on the ALB and rely on its automatic Layer 3/4 DDoS mitigation to drop the excessive HTTP requests.

Answer

Configure the ALB security group to deny inbound traffic from IP ranges that historically generate high request volumes.

Answer

Create a Network ACL on the ALB subnets that limits the number of connections per source IP address per second.