AWS Builder Center

Builder Center

Application Security - DDoS protection

Application Security - DDoS protection

Applications built on AWS benefit from native DDoS protections and can be designed to be highly resilient against these attacks using AWS services.

Achraf Souk

Overview

Distributed Denial of Service (DDoS) attacks are malicious attempts to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic. If not mitigated effectively, DDoS attacks can lead to impaired availability or degraded response times for web applications, and undesired scaling costs. Using AWS services and security controls, web applications can be designed to be highly resilient against DDoS attacks.

AWS native protections against DDoS attacks

Security is a shared responsibility between AWS and the customer. AWS is responsible for protecting the infrastructure that underpins its cloud services. To safeguard its infrastructure against DDoS attacks, AWS invest in:
  • Layer 3 and layer 4 protection systems that detect infrastructure DDoS attacks using various sources, such as NetFlow from networking devices and service logs, and mitigate them using Deep Packet Inspection, firewall rules, and traffic shaping. Scrubbing systems of certain AWS services like CloudFront and Route 53, constantly inspect incoming traffic, enabling sub-second detection and mitigation. In contrast, scrubbing systems of regional AWS services like ALB or EC2, inspect incoming traffic after detection, enabling detection and mitigation within minutes.
  • Layer 7 protection systems that detect and mitigate certain HTTP floods that can overwhelm hosts of services like CloudFront and ALBs .
  • Shield Response Team that drive rapid resolution of DDoS attacks that are not automatically detected and mitigated by the monitoring and scrubbing systems.
  • Threat Intelligence Team that operate threat intelligence gathering systems , and is responsible for disrupting attack infrastructures of threat actors , effectively making AWS an un-attractive target for carrying DDoS attacks.

Best practices for building DDoS-resilient web applications on AWS

AWS provides capabilities to protect, monitor, and respond to DDoS attacks within your responsibility scope of the shared responsibility model. It's recommended to:
  • Use CloudFront for web applications, and Global Accelerator for other use cases to benefit from hundreds of Tbps of mitigation capacity across the AWS distributed edge network. Both CloudFront and Global Accelerator employ advanced DDoS mitigation techniques such as SYN Proxy, which provides protection against SYN floods by sending SYN cookies to challenge new connections before they are allowed to continue upstream. CloudFront provides the fastest (sub-millisecond) and the most complete protection against all known Layer 3 and 4 DDoS attacks, against certain DDoS attacks that target the HTTP protocol such as Slowloris and HTTP/2 rapid reset  attacks, and against certain HTTP floods that can overwhelm its hosts.
  • Reduce the attack surface of your origins using Origin Cloaking techniques .
  • Block HTTP Floods using AWS WAF, using different techniques, described in the following section.
  • Prepare your application to scale, for example, using autoscaling with EC2-based origins.
  • Monitor  your application behavior to alarm on abnormal activities, analyze threats , and respond using pre-established runbooks with the possibility to engage AWS Shield Respond team for support, when you are subscribed to Shield Advanced.

Block HTTP floods using AWS WAF

To effectively block HTTP floods (DDoS attacks at Layer 7), add multiple layers of rules in AWS WAF, using a range of possible actions, such as Block, rate limit, JavaScript Challenge or CAPTCHA. Actions can be dynamically adapted based on the perceived threat level, as shown in this sample solution .

Implement positive security when possible

You can add rules in AWS WAF to reduce the surface attack of your application, by denying any unexpected request patterns. For example, you can write rules to deny requests with URLs not adhering to your API URL schemes, requests with HTTP verbs not supported by your API, or simply Host header values not part of your domain names. Such rules block undesired traffic immediately.

Leverage AWS Threat intel for immediate response

AWS WAF offer rules based on IP reputation which immediately block traffic from IPs with bad reputation. You can use Amazon Managed rules  based on threat intelligence  gathered by AWS, Managed rules for AWS WAF by vendors from the AWS Marketplace, such as Imperva , or you can build your own IP reputation list and automatically update  AWS WAF. The AWSManagedIPDDoSList rule, has been observed blocking over 90% of malicious request floods.

Apply rate limits

Rate limiting rules  in AWS WAF are designed to prevent your web applications from being overwhelmed by a large number of requests within a short period of time.
The rule aggregates requests according to configurable dimensions  (e.g. IP, cookie, label, conditions) over a configurable evaluation window (1 min, 2 mins, 5 mins or 10 mins) every few seconds. Then, if the total number of requests in an aggregated bucket exceeds the configured threshold (starting from as low as 10), AWS WAF will apply the configured rate limiting rule action until the number goes below the threshold. If you want to extend the blocking duration of rate limits, implement the custom solution described in this blog . From breaching the limit to taking action, rate limiting rules take 20 to 30 seconds, and are usually faster with the shorter evaluation windows (1 min & 2 mins). The maximum number of IP addresses that AWS WAF can rate limit using a single rate-based rule instance is 10,000.
It's recommended to combine multiple rate limiting rules with different configurations to increase your protection coverage against DDoS attacks. Examples of rate limiting rules include: A blanket IP based rule with high thresholds (e.g. 2,000), URI specific (e.g. /login) IP based rule with lower thresholds (e.g. 100), cookie based to block offending authenticated sessions, ASN based rule for traffic coming from outside of countries where you normally operate business. Read more about rate limiting examples in the following resources:

Use the Anti-DDoS Managed rule group

The Anti-DDoS managed rule group  quickly establishes a baseline of your traffic and uses it to detect anomalies within seconds. When the Anti-DDoS AMR detects a DDoS attack, it adds the event-detected label to all incoming requests, and the ddos-request label to incoming requests that are suspected of contributing to the attack. It also adds an additional confidence-based label, such as high-suspicion-ddos-request, when the request is suspected of contributing to the attack. In AWS WAF, a label is metadata added to a request by a rule when the rule matches the request. Once added, a label is available for subsequent rules, which can use it to enrich their evaluation logic. The Anti-DDoS AMR uses the added labels to mitigate the DDoS attack.
Default mitigations are based on a combination of Block and JavaScript challenge  actions. Challenge actions force the user's browser to execute a JavaScript code in a silent way. The script solves a problem and submits the result to AWS WAF for validation. Compared to Block actions, JavaScript challenge actions result in less false positives. The Challenge action can only be handled properly by a client that's expecting HTML content. For this reason, you need to exclude the paths of non-challengeable requests (e.g. API fetches) in the Anti-DDoS AMR configuration.
Read the following resources for advanced configurations of the Anti-DDoS Managed rule group:
Note that requests contributing to DDoS attacks, that are blocked by Anti-DDoS AMR are neither charged by AWS WAF nor by CloudFront.

Add Bot Control to mitigate pervasive bots contributing to DDoS attacks

Pervasive attackers, can implement advanced techniques to bypass some of the mitigations techniques described before. For example, they can use browser automation to solve JavaScript challenges at scale behind residential proxies. AWS WAF Bot Control  is managed rule in AWS WAF that is designed to detect distributed bot infrastructure that is used to conduct sophisticated malicious activities against your web application, including DDoS attacks.
Compared to the Anti-DDoS managed rule, Bot Control provides more detection (e.g. Client-side fingerprinting, session-based behavioral analysis, and ML-based detections for coordinated activities), and allows you to apply more granular mitigations. The client-side SDK allows you to challenge requests for web pages and APIs in an always-on fashion, instead of being activated during an attack. Finally, Bot Control help against general bot threats, such as content scraping.

Enhance your DDoS resiliency using Shield Advanced

AWS Shield Advanced  is a subscription based service, that enhances your resilience against DDoS attacks thanks to:
  • 24/7 support from the Shield Response Team (SRT) during DDoS attacks. The SRT assists you during DDoS attacks that were not automatically mitigated by CloudFront and AWS WAF. For example, they can manually write WAF rules on your behalf to mitigate the attack.
  • Protection against Denial of Wallet. When enabled on a resource, the price of Shield Advanced includes the basic WAF costs, and protects you against DDoS-related spikes in your EC2, ELB, Global Accelerator, and Route 53 costs.

Value added by AWS Shield Response Team

Protecting on premises data centers

If you are running workloads in your own data centers, you can still benefit from AWS protections against DDoS attacks. First, expose your workload to the internet from an AWS service, such as CloudFront, Global accelerator or Elastic load balancers, where you can implement protections against DDoS attacks. Second, hide your on premises data center network from the internet, by keeping an exclusive route to AWS using Direct Connect.

Testing DDoS resilience

DDoS simulation testing is permitted on AWS, and it is subject to the terms and conditions detailed on this page . AWS offers two options for running DDoS simulation tests: Either a simulated DDoS attack in production traffic with an authorized pre-approved AWS Partner such as NCC Group plc, RedWolf, Red Button and Safedash Analytics; or a synthetic simulated DDoS attack with the Shield Response Team, also referred to as a fire drill. For more information, read this blog .

Resources

# aws-edge-services# security
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article