Question

A SysOps administrator manages a public web application behind an Application Load Balancer. During a recent event, a single source IP sent an overwhelming volume of HTTP requests, degrading performance for legitimate users. The application logic itself is fine, but the team wants an automated way to throttle any client that exceeds a request threshold over a short window without manually maintaining IP lists. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Associate an AWS WAF web ACL with the ALB and add a rate-based rule that blocks source IPs exceeding the configured request threshold within the evaluation window.

Answer

Create a network ACL on the subnet and manually add deny entries for offending IP addresses as they are identified in the access logs.

Answer

Enable AWS Shield Advanced and rely on its automatic Layer 3/4 mitigation to drop the excessive HTTP requests.

Answer

Configure a security group rule on the ALB to limit the number of concurrent connections from any single IP address.