AWS' competition like OVH and many quality VPS providers offer _free_ (or very cheap) DDOS protection.
If the attack is over 10Gbps good luck with that... This stuff is best effort.
AWS Best Practices for DDoS Resiliency [pdf]
21–30 of 47 posts
Re: AWS Best Practices for DDoS Resiliency [pdf]
#22> Scaling buys you time to analyze the DDoS attack and respond with countermeasures.
They're not saying "scale up and just pay for it", they're saying use autoscaling as a tool to give you time to respond, Without first going down.
Re: AWS Best Practices for DDoS Resiliency [pdf]
#23I share falcolas's take on it. On other end, Cloudfare says "Pay us $200-5,000 (avg) a month, we'll handle the details, and don't worry about a data bill." AWS method sounds like a step backwards in cloud DDOS protection. Or a step forward in their next annual report. Whichever. ;) I'm still a believer in the value of dial-up, leased lines, satellite, or radio for aiding security. You still have to apply protection t…
[deleted]
Re: AWS Best Practices for DDoS Resiliency [pdf]
#24This whole thing reads like a "please buy everything we make" guide, not a guide to DDOS resiliency. Trying to outscale a large DDOS doesn't often work. Don't worry though, amazon's happy to help let you try to pay for it!
Having been on the wrong side of this equation, I can say this is exactly what they expect you to do and it's a fool's errand. I've a client on AWS faced with routine DDoS-scale spikes of traffic at certain points in the year.
The client's app almost always goes down in the midst of the fury. The point of failure typically comes down to amazon's load balancers or an auto-scaling failure. In the end our friends at amazon tell us to add more, bigger servers to 'outscale' the traffic and put the blame on us when everything blows up. sigh
Re: AWS Best Practices for DDoS Resiliency [pdf]
#25Kind of agree with all those who say that Cloudflare is still a better option. But how do you tackle their lack of automatic failover ?
https://support.cloudflare.com/hc/en-us/articles/200168916-C...
"the system currently does not have the functionality to automatically select the next available server if one of the servers in the group goes down"
Re: AWS Best Practices for DDoS Resiliency [pdf]
#26Kind of agree with all those who say that Cloudflare is still a better option. But how do you tackle their lack of automatic failover ? https://support.cloudflare.com/hc/en-us/articles/200168916-C... "the system currently does not have the functionality to automatically select the next available server if one of the servers in the group goes down"
We're fixing that.
Re: AWS Best Practices for DDoS Resiliency [pdf]
#27Rule #1 to surviving a DDoS, keep your DNS TTL's low on those A records. Not super low, but low. 10 minutes (600 seconds) is enough. There's no point in a TTL larger than that if you're on AWS and need to start mitigating an attack. Even if you sign up with a provider like Cloudflare or F5 Silverline, you'll need to send them the traffic. If you're on AWS, you can't have them announce your routes, so the only way around it is to change DNS. If your DNS TTL is at a day, no one who has the lookup cached is going to reach your new "clean pipe".
I can't imagine trying to survive a volumetric attack in AWS. Must be a nightmare. Luckily volumetric attacks are on the out and layer 7 attacks are all the rage these days. They're easier to handle in AWS with a WAF or filter.
tl;dr keep the TTLs on your DNS A records to a maximum of 10 minutes.
Re: AWS Best Practices for DDoS Resiliency [pdf]
#28I'm really surprised that AWS doesn't offer a DDoS mitigation service. They have the capacity in terms of compute and network (N/S and E/W). Why not offer a filtering product that uses BGP offramping? Not saying they need to run out an buy a bunch of Arbor gear, but I'd bet they could write their own rudimentary filter product given their resources.
Edit: Considering that Jeff from BlackLotus is now PM of DDoS at AWS, I'm sure they are working on something.
Re: AWS Best Practices for DDoS Resiliency [pdf]
#29Kind of agree with all those who say that Cloudflare is still a better option. But how do you tackle their lack of automatic failover ? https://support.cloudflare.com/hc/en-us/articles/200168916-C... "the system currently does not have the functionality to automatically select the next available server if one of the servers in the group goes down"
The simplest option I'm aware of is to point CloudFlare to your load balancer, and have it handle removal of failed backend nodes.
The only big downside is that on AWS you can't have an elastic IP associated with an elastic load balancer, so you either have to run your own HA haproxy/nginx/whatever cluster in EC2 in order to have a single IP to point CloudFlare to.
If you can live with a subdomain you can point that cname to an ELB.
Alternatively, CloudFlare's API is pretty reasonable, so you could home-brew health checks that de-register dead nodes from CloudFlare. Even a simple nagios check handler could do that.
Re: AWS Best Practices for DDoS Resiliency [pdf]
#30One thing missing from the quick is operational guidance on how to make this all work smoothly. A big key to using an "all AWS" model (which as most have pointed out isn't the only or necessarily best option) is that scaling isn't instant.
You need to add some additional logic to smooth out the rate of scaling. Most deployments fall down when the rate of scaling can't keep up with the demand.
In general the white paper provides some solid AWS-specific & AWS-centric guidance on how to buy yourself some time. It's not the end-all, be-all but a good start