Question

A financial services company runs a public web application behind an Application Load Balancer (ALB) fronted by CloudFront. During a recent event, the application experienced a large volume of HTTP GET floods that mimicked legitimate user traffic, causing backend exhaustion. The security team has already subscribed to AWS Shield Advanced. They want automatic layer 7 DDoS mitigation with the ability to have the AWS Shield Response Team (SRT) actively engage during attacks, and they want to minimize false positives against real users. Which configuration best meets these requirements?

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution, enable Shield Advanced automatic application layer DDoS mitigation on the protected resource, and configure the SRT engagement (proactive engagement) with contact details.

Answer

Rely on AWS Shield Standard's automatic layer 3/4 protections and add network ACL rules on the ALB subnets to rate-limit HTTP requests from suspicious source ranges.

Answer

Enable Shield Advanced on the ALB only, and create security group rules that drop connections exceeding a defined connections-per-second threshold at the instance level.

Answer

Configure AWS Network Firewall in front of the ALB with a stateful rule group that inspects HTTP payloads and drops GET floods, then grant the SRT read access to the firewall logs.