Anti DDOS on AWS [closed]

Question

I have a big site on ec2, many images on s3, cloudfronter. I know about load balancer by Amazon.

I know many ddos tools, so the question is, how to protect ec2, cloudfronter+s3 from ddos?

Thanks.

Answer 1

I believe this question generally comes under the header of "shopping" or "software suggestions", but I'll try to offer an answer.

Typically, you don't really need DDoS protection if you're running on Amazon Web Services. This is because Amazon's infrastructure is good enough to absorb most attacks before they reach you, if you run your own services properly.

This is part of the reason why AWS is a very attractive option for many - you're essentially "standing on the shoulders of giants" and letting someone who is more knowledgeable/has more resources than you handle the infrastructure.

That said, Amazon can't do anything about DDoS attacks against your own services, so it's your responsibility to ensure that your web servers and any other services are configured properly.

My advice for Amazon (in no particular order - you may be doing some of these already):

• Run behind an Elastic Load Balancer (ELB) and use Auto-Scaling to scale depending on load
• Use sane limits for your autoscaling to ensure that a targeted DDoS attack doesn't spool up 100 instances and cost you a fortune.
• Run your servers inside a Virtual Private Cloud (VPC)
• Use CloudFront and S3 to offload serving your static content.
• Use Route 53 for your DNS - R53 is extremely well-protected on its own.

And above all, make sure that your application is written properly and doesn't have any exploitable holes. Even if your infrastructure can handle a DDoS, you can avoid one in the first place by having an efficient application that you can't attack.