AWS Best Practices for DDoS Resiliency [pdf]

Post by robbles » Sat, Jul 04, 2015, 9:21 PM UTC

buro9 wrote: post #12

jakozaur wrote: post #4

Alternative guide, use CloudFlare and hide origin address. Most of AWS advices (like autoscaling) will help only a bit, but can cost a lot (lots of ec2 machines serving bogus requests).

Best way to defend against an L7 DDoS is to have the origin hidden, and to cache everything at a large number of geographically distributed PoPs. This helps in 99% of cases, and where it doesn't it is simply because there is a resource that cannot be cached and that the edge must revisit the origin for. This is especially true whenever that resource is expensive for the origin to provide (involves database lookups an…

Post by kyledrake » Sat, Jul 04, 2015, 9:45 PM UTC

Post by manigandham » Sat, Jul 04, 2015, 10:12 PM UTC

tpg wrote: post #29

chdir wrote: post #25

Kind of agree with all those who say that Cloudflare is still a better option. But how do you tackle their lack of automatic failover ? https://support.cloudflare.com/hc/en-us/articles/200168916-C... "the system currently does not have the functionality to automatically select the next available server if one of the servers in the group goes down"

The simplest option I'm aware of is to point CloudFlare to your load balancer, and have it handle removal of failed backend nodes. The only big downside is that on AWS you can't have an elastic IP associated with an elastic load balancer, so you either have to run your own HA haproxy/nginx/whatever cluster in EC2 in order to have a single IP to point CloudFlare to. If you can live with a subdomain you can point that…

Post by derefr » Sat, Jul 04, 2015, 10:37 PM UTC

manigandham wrote: post #35

tpg wrote: post #29

Earlier quoted context omitted.

The simplest option I'm aware of is to point CloudFlare to your load balancer, and have it handle removal of failed backend nodes. The only big downside is that on AWS you can't have an elastic IP associated with an elastic load balancer, so you either have to run your own HA haproxy/nginx/whatever cluster in EC2 in order to have a single IP to point CloudFlare to. If you can live with a subdomain you can point that…

CloudFlare has CNAME flattening so you can still have the apex point to a CNAME and CF will automatically keep up to date with the correct IP using the TTLs and broadcast an A record correct to RFC standards. https://support.cloudflare.com/hc/en-us/articles/200169056-C...

Post by [deleted] » Sat, Jul 04, 2015, 10:42 PM UTC

Thaxll wrote: post #32

aschwabe wrote: post #21

Earlier quoted context omitted.

If the attack is over 10Gbps good luck with that... This stuff is best effort.

I don't think so, 2years ago they mitigated 180gbps on one client. https://twitter.com/olesovhcom/status/386563685805617152/pho... https://www.ovh.com/ca/en/anti-ddos/ddos-attack-management.x... Also everyone here talk about L7, cloudflare ect.. but a lot of application are pure TCP/UDP based so you can't cache anything.