11–20 of 47 posts
This would be more convincing if it at least mentioned CloudFlare for the purpose of telling some lie about how AWS's similarly-named service is just as good.
Alternative guide, use CloudFlare and hide origin address. Most of AWS advices (like autoscaling) will help only a bit, but can cost a lot (lots of ec2 machines serving bogus requests).
This helps in 99% of cases, and where it doesn't it is simply because there is a resource that cannot be cached and that the edge must revisit the origin for. This is especially true whenever that resource is expensive for the origin to provide (involves database lookups and cannot be cached: shopping carts, login pages, search results), these are the ones which require you to rethink your application design.
If you're an application developer and wondering how to design your application to withstand a DDoS attack, then instead shift to just thinking: How can I make everything that this application does be cached by an edge server?
When you're not under attack using CloudFlare makes sense and saves you money anyway. At least... it does for me. On one of my web applications I use Amazon S3 for user attachment storage within a forum CMS, and my bill used to be upwards of $200 per month for just one of the sites I run. I changed the application so that it proxies the S3 request/response, and then set a CloudFlare Page Rule to sit in front of that path, and configured it to "Cache Everything". The effect of this was to reduce my AWS S3 bill down to $20 per month. After that I did it for every site.
There's a hell of a lot of benefit to using CloudFlare in conjunction with AWS, and not just when you're facing an L7 DDoS.
Disclosure: I work for CloudFlare (last 9 months) and have been a CloudFlare customer for 3 years and I was offered a job by AWS and also been an AWS customer for 3 years.
This whole thing reads like a "please buy everything we make" guide, not a guide to DDOS resiliency. Trying to outscale a large DDOS doesn't often work. Don't worry though, amazon's happy to help let you try to pay for it!
What if you can't absorb the cost that is attached with scaling ?
So, maybe it's what's worked for them, their thinking hasn't really changed, and now they're just offering others the same thing? And upselling them in the process? Thoughts?
[1] http://money.cnn.com/2010/12/09/technology/amazon_wikileaks_...
Another thing just occurred to me: Amazon might just be guilty of recommending to others what worked for them without thinking twice about context, alternatives, etc. Long ago, Anonymous tried a massive DDOS attack on all kinds of sites from Mastercard to Amazon. Of them all, Amazon didn't take a scratch [1]. This was due to their then-new EC2 architecture for handling spikes and a ridiculous amount of spare capacity…
So, basically, pull out the pocketbook and we'll hook up our vacuum to it. Attempting to outscale a DDOS (the primary mitigation method presented by Amazon) is going to DDOS your bank account. Personally, I'd rather see some more recommendations along the lines of the "VPC can minimize potential attack surfaces".
Remotely triggered black holes for VPC? Elastic Firewall?
Not crazy about firewalls in general, but they would help in the case that you are paying for data-out.