Question

A company runs a public-facing e-commerce application behind an Application Load Balancer with EC2 targets in an Auto Scaling group. Over the past month, the security team has observed periodic surges of automated traffic that scrape product pricing and probe login endpoints with credential-stuffing attempts. These surges trigger the Auto Scaling group to scale out, increasing cost, and occasionally degrade the login API for legitimate users. The team wants to improve the security posture and reduce the cost impact with the least operational overhead and without rearchitecting the application. Which solution best meets these requirements?

Accepted Answer

Associate an AWS WAF web ACL with the ALB, enable the AWS Managed Bot Control rule group and the Account Takeover Prevention (ATP) rule group, and add a rate-based rule scoped to the login path.

Answer

Move the application behind an Amazon CloudFront distribution and rely on the default AWS Shield Standard DDoS protection to block the scraping and credential-stuffing traffic.

Answer

Implement a custom Lambda@Edge function that parses request headers and maintains a DynamoDB table of request counts per source IP to reject abusive clients before they reach the ALB.

Answer

Enable GuardDuty and create an EventBridge rule that invokes a Lambda function to update ALB security group rules whenever a suspicious source IP is detected.