DDoS Attack

A Distributed Denial of Service (DDoS) attack floods a target with traffic from multiple sources (a botnet) to exhaust its resources and make it unavailable. Attacks can target different network layers:

• Layer 3/4: volumetric floods (UDP, SYN) that saturate bandwidth
• Layer 7: application-layer attacks (HTTP floods) that exhaust server resources

AWS DDoS Protection

• AWS Shield Standard: free, automatic L3/L4 protection for all AWS resources
• AWS Shield Advanced: 3,000 USD/month with a 1-year subscription commitment; dedicated DDoS response team, cost protection, advanced detection
• CloudFront: absorbs traffic at edge locations worldwide
• AWS WAF: rate limiting and bot protection at L7
• Route 53: DNS-level DDoS protection with health checks and failover

Architecture Beats Products

The most effective DDoS posture on AWS is architectural. Volumetric floods are best absorbed as far from your origin as possible, which is what CloudFront and Route 53 do by answering at hundreds of edge locations instead of your two load balancers. Behind the edge, keep origins private: an Application Load Balancer or EC2 instance with a public IP is individually addressable and individually floodable, while an origin reachable only from CloudFront inherits the edge's absorption capacity. Layer 7 floods are cheaper for attackers and harder to filter, because each request looks legitimate; that is where WAF rate-based rules, bot control, and application-level caching carry the load. Finally, elasticity is a real mitigation but also a billing risk: auto scaling can ride out an attack while turning it into an expensive one, which is exactly the scenario Shield Advanced's cost protection exists for.

How It Goes Wrong in Practice

The classic misconfiguration is the exposed origin. A team puts CloudFront and WAF in front of an application and considers the DDoS box ticked, but the origin ALB keeps its public DNS name and permissive security group. Attackers do not politely aim at your CDN: they find the origin through DNS history, TLS certificate transparency logs, or simple scanning, then flood it directly, bypassing every edge protection you paid for. The fix is origin cloaking: restrict the origin's security group to CloudFront's managed prefix list so only CloudFront can reach it, and require a secret custom header (validated by WAF at the origin) so cache-busting requests cannot be replayed straight at the ALB. The second recurring failure is having no rate-based WAF rule at all until the first HTTP flood, then writing one in panic during the incident; a rate limit that is generous but present is far easier to tighten under attack than to create from scratch.

A Practical Check: Confirming Your Shield Posture

Teams are sometimes genuinely unsure whether their organization pays for Shield Advanced. The answer is one call:

aws shield get-subscription-state

It returns a SubscriptionState of ACTIVE or INACTIVE. If it is ACTIVE, follow up by confirming your critical resources (CloudFront distributions, ALBs, Elastic IPs, Route 53 zones) are actually registered as protected resources, because the subscription alone does not attach protection to anything.

Frequently Asked Questions

Is AWS Shield Standard really free?

Yes. Shield Standard is included automatically for all AWS customers at no additional charge and defends against the most common network and transport layer attacks. You never enable it; it is always on.

Do I need Shield Advanced?

Not always. Its 3,000 USD monthly fee with a 1-year commitment buys the Shield Response Team, cost protection against scaling charges during attacks, and enhanced detection and reporting. A small workload behind CloudFront with sensible WAF rate limiting already has strong protection from Standard. Shield Advanced makes sense when downtime is measured in serious money, when you need humans from AWS in the incident call, or when the billing exposure of an attack-driven scale-out is itself a business risk.

Does CloudFront help even if my content is dynamic and uncacheable?

Yes. Even with caching disabled, CloudFront terminates connections at the edge, absorbs L3/L4 floods across its global capacity, filters malformed traffic, and gives WAF a single enforcement point in front of your origin. The origin then only ever sees traffic that survived the edge.

What is the difference between a DoS and a DDoS attack?

Source count. A DoS attack comes from a single source and is usually trivial to block with a rate limit or an IP block. A DDoS attack is distributed across thousands or millions of sources, typically a botnet, which is why mitigations focus on absorption capacity and behavioral filtering rather than blocklists.