Question

A company hosts a public web application behind Amazon CloudFront with an Application Load Balancer origin. During a recent event, attackers sent a high volume of legitimate-looking HTTP GET requests from thousands of distinct IP addresses, overwhelming the origin servers. The requests passed TLS validation and did not match any obvious malicious signatures. The security team needs to mitigate this type of HTTP flood with minimal impact on real users and no application code changes. Which solution best addresses this requirement?

Accepted Answer

Attach an AWS WAF web ACL to the CloudFront distribution with a rate-based rule that blocks source IPs exceeding a request threshold, combined with the AWS Managed Rules Bot Control rule group.

Answer

Configure network ACLs on the ALB subnets to deny inbound traffic from the offending IP ranges as they are identified.

Answer

Enable AWS Shield Standard on the ALB and rely on its automatic Layer 7 detection to drop the excess HTTP requests.

Answer

Add security group rules on the EC2 instances restricting inbound port 443 to a fixed allowlist of known corporate IP addresses.