DDoS Attack
Your application is under a DDoS attack - users cannot access your services, latency is spiking, and requests are timing out. AWS provides built-in DDoS protection (Shield Standard) and optional advanced protection (Shield Advanced), but you need to act fast to mitigate the impact.
Phase 1: Detection
Check AWS Shield Dashboard
AWS Shield Standard automatically protects against L3/L4 DDoS attacks. Check the Shield dashboard for active events.
# Note: Shield CLI commands require Shield Advanced subscription aws shield list-attacks \ --start-time FromInclusive=<epoch-seconds> \ --end-time ToExclusive=<epoch-seconds>
aws shield describe-attack --attack-id <attack-id>
Monitor CloudWatch metrics for anomalies
Check request rates, 5xx errors, latency, and network throughput on your ALB/CloudFront distribution.
# ALB request count aws cloudwatch get-metric-statistics \ --namespace AWS/ApplicationELB \ --metric-name RequestCount \ --dimensions Name=LoadBalancer,Value=<alb-arn-suffix> \ --start-time <1h-ago> --end-time <now> \ --period 60 --statistics Sum
Analyze WAF logs for attack patterns
If WAF is enabled, check sampled requests to identify attack signatures (user agents, IPs, request patterns).
aws wafv2 get-sampled-requests \ --web-acl-arn <web-acl-arn> \ --rule-metric-name <rule-name> \ --scope REGIONAL \ --time-window StartTime=<1h-ago>,EndTime=<now> \ --max-items 100
Phase 2: Containment
Enable WAF rate-based rules
Add a rate-based rule to block IPs exceeding a request threshold (e.g., 2000 requests per 5 minutes).
# Rate-based rules are configured in the WAF console
# or via update-web-acl with a RateBasedStatement
aws wafv2 update-web-acl \
--name <web-acl-name> \
--scope REGIONAL \
--id <web-acl-id> \
--lock-token <token> \
--default-action '{"Allow":{}}' \
--visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"web-acl-metric"}' \
--rules file://rate-limit-rule.jsonStart with a higher threshold and lower it gradually to avoid blocking legitimate traffic.
Deploy geographic restrictions if the attack comes from specific regions
If the attack traffic originates from countries where you have no users, apply geo-blocking via WAF or CloudFront.
aws cloudfront update-distribution \ --id <distribution-id> \ --distribution-config file://geo-restriction-config.json
Scale up your infrastructure
While mitigation takes effect, scale up ALB capacity, increase Auto Scaling group limits, and enable CloudFront caching.
Phase 3: Eradication
Block identified attacker IPs
Create a WAF IP set with the attacker IPs and add a blocking rule.
aws wafv2 create-ip-set \ --name "DDoS-Blocked-IPs" \ --scope REGIONAL \ --ip-address-version IPV4 \ --addresses "1.2.3.4/32" "5.6.7.0/24"
Enable AWS Shield Advanced (if not already enabled)
Shield Advanced provides DDoS Response Team (DRT) support, advanced mitigation, and cost protection.
Shield Advanced costs $3,000/month but includes DDoS cost protection - AWS will credit charges from scaling during the attack.
Engage AWS Shield Response Team (if Shield Advanced)
Contact the DRT for expert assistance with active DDoS mitigation.
aws shield create-protection \ --name "Production-ALB" \ --resource-arn <alb-arn>
Phase 4: Recovery
Monitor for attack resumption
DDoS attacks often come in waves. Monitor for 24-48 hours after the initial attack subsides.
Review and optimize WAF rules
Based on the attack patterns observed, fine-tune your WAF rules to better protect against similar future attacks.
Scale infrastructure back to normal
Once the attack has fully subsided, return Auto Scaling group limits and other temporary changes to normal.
Phase 5: Lessons Learned
Deploy CloudFront in front of all public endpoints
CloudFront absorbs DDoS traffic at the edge, preventing it from reaching your origin. All public-facing apps should use CloudFront.
Pre-configure WAF rate-limiting rules
Have rate-based rules in place before an attack. Reactive rule deployment during an attack is slower.
Create a DDoS response runbook
Document the steps your team took during this incident and create a reusable runbook for the next attack.
Related Content
Need Help with Incident Response?
When an incident strikes, every minute counts. We help AWS teams prepare, detect, and respond to security incidents with proven expertise.