Question

A financial services company runs a public-facing web application behind a CloudFront distribution and an Application Load Balancer. After a recent volumetric attack, leadership wants the highest level of DDoS protection, including cost protection against scaling charges caused by attacks and access to a team of AWS specialists that can proactively engage during an event. The security team also wants automated application-layer (Layer 7) DDoS mitigation. Which approach meets all of these requirements?

Accepted Answer

Enable AWS Shield Advanced on the CloudFront distribution and ALB, engage the Shield Response Team (SRT), and enable automatic application-layer DDoS mitigation with an associated WAF web ACL.

Answer

Rely on AWS Shield Standard, which is automatically enabled for all AWS customers, and attach a rate-based AWS WAF rule to the ALB.

Answer

Enable AWS Shield Advanced only on the ALB and configure GuardDuty to notify the SRT when an attack is detected.

Answer

Deploy AWS Network Firewall in the VPC with stateful rules to drop volumetric traffic and open an AWS Support case during each attack.