Question

A company runs a public web application behind an Application Load Balancer (ALB) fronted by CloudFront. After a large volumetric DDoS attack, they received a significant AWS bill for the scaling and data transfer costs incurred during the event. Leadership wants automatic protection against future attacks and financial protection against attack-driven usage spikes on their protected resources. Which action best meets these requirements?

Accepted Answer

Subscribe to AWS Shield Advanced, add the CloudFront distribution and ALB as protected resources, and rely on Shield Advanced cost protection for scaling charges caused by DDoS attacks

Answer

Rely on the default AWS Shield Standard protection and open an AWS Support case after each attack to request billing credits for the extra costs

Answer

Configure a WAF rate-based rule on the ALB and set a monthly AWS Budgets alert to cap spending automatically

Answer

Enable Shield Advanced only on the ALB, since CloudFront volumetric attacks are always absorbed at no cost under Shield Standard