This document discusses how to protect web applications from DDoS attacks on AWS. It covers the types and trends of DDoS threats, best practices for web architecture, and AWS security services like AWS Shield, AWS WAF, and Firewall Manager that provide built-in and customizable DDoS mitigation. It also includes a demo and discusses pricing models for AWS DDoS protection services.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Vladimír Šimek, Sr. Solutions Architect @ AWS
May 2019
DDoS Mitigation on AWS
How to protect your web applications

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• Types of threats & trends in DDoS attacks
• Web architecture – Best Practices
• AWS Shield
• AWS WAF and Firewall Manager
• Pricing
• Demo

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat landscape

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of threats
Application
Ping of Death | ICMP Flood | Teardrop | reflections | UDP floods
SYN/ACK Flood | SSL Abuse
Presentation
Session
Transport
Network
HTTP Flood |
Malformed HTTP
App exploits |
CVE |s XSS |
SQLi | RFI
Bots |
Scrapers |
Crawlers
Bad BotsDDoS
Web Application
Attacks

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Trends of DDoS attacks
0
200
400
600
800
1000
1200
1400
1600
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
Largest DDoS Attacks (Gbps)
Largest DDoS Attacks
Memcached Attacks
Mirai Attacks

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DDoS Attack threats and Trends:
Network / Transport Layer DDoS

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Evolution of WAF & DDoS mitigation
On-Premise Cloud-Routed Cloud-Native

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud native protection

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pillars of perimeter protection
MONITOR
RESPOND
PREPARE
Build a DDoS resilient
application on AWS
Be aware of threat
environment and
application health
Engage response team

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DDoS resilient architecture
Route 53
ALB Security Group
EC2
Instances
Application
Load Balancer
CloudFront
Public Subnet
Web Application
Security Group
Private Subnet
AWS WAF
DDoS
Attack
Users
Cloudwatch
S3
API
Gateway

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud native protection
Built-in protection Protection tools
Always-on
Automatic
Distributed
Easy to use
Customizable
APIs
AWS scale Experts support

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Layer 3/4 Protection for Everyone
 Automatic defense against the most common network
and transport layer DDoS attacks for any AWS resource, in
any AWS Region
 Comprehensive defense against all known network and
transport layer attacks when using Amazon CloudFront
and Amazon Route 53
 SYN Floods, UDP Floods, Reflection Attacks, etc.
Layer 7 Protection Available via AWS WAF
 Self-service & pay-as-you-go
 Flexible rule language
 Fast rule propagation
AWS Shield
Standard
AWS WAF
AWS Shield Standard

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS WAF
Managed layer 7 inspection and mitigation tool,
monitors HTTP/S requests and protects web
applications from malicious activities
Custom Rules Security AutomationManaged Rules

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS WAF benefits
AWS WAF
Easy to deploy
Fast incident response
Affordable
Full API support
Managed service

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Custom rules
1. Define conditions: IP Match, Geo-IP, String Match, Regex Match,
SQLi, XSS, Size Constraints
2. Define rules: Regular or rate based
3. Add to Web Access Control Lists: Order & action (Block, Allow,
Count)
4. Attach to AWS Resource: CloudFront, ALB

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Seller managed rules
Rules managed by experts
Choice of 6 partners
Pay as you go
Easy to deploy
automatic updates

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security automations
Honeypot for
bad bots
CloudFront
Log parsing
Reputation

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Firewall manager
• Central
management for
Security profile
• Automated policy
enforcement across
accounts &
applications
• WAF rule sets

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Additional detection & monitoring
Advanced protection
Visibility into attack detection & mitigation
AWS WAF & FM at no additional cost
24X7 DDoS Response Team
Cost protection (absorb scaling costs)
Advanced Protection
AWS Shield
Advanced

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Classic Load
Balancer
Amazon
Route 53
Application
Load Balancer
Amazon
CloudFront
EC2 Instances
Network Load
Balancer
Elastic IP Address
AWS Shield Advanced:
Available for 6 AWS Services

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudWatch metrics for Shield Advanced
Metrics:
• DDoSDetected
• DDoSAttackBitsPerSecond,
DDoSAttackPacketsPerSecond,
DDoSAttackRequestsPerSecond
Dimensions:
• UDPTraffic, DNSReflection,
SYNFlood, RequestFlood…

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
attacks
MONITOR
RESPOND
PREPARE
AWS ShieldInternet
Cloud native protection in a nutshell
AWS
services
AWS WAF
Customer
infrastructure
Application
Presentation
Session
Transport
Network
Web
Application
Attacks
DDoS
Bad Bots
x x x x
MONITOR
RESPOND
PREPARE
DDoS
Cloudwatch CloudFront
Access logs
DDoS
Response
Team
Security Automation

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pricing

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Shield Pricing
Pricing AWS Shield Standard AWS Shield Advanced
Subscription Commitment None 1 Year*
Monthly Fee No additional cost $3,000
Data Transfer Out Usage
Fees
No additional cost See below
Data Transfer Out
Amazon CloudFront
Elastic Load
Balancing (ELB)
AWS Elastic IP (EC2
and Network Load
Balancer)
AWS Global
Accelerator
First 100TB $0.025 $0.050 $0.050 $0.050
Next 400TB
$0.020
$0.040 $0.040 $0.040
Next 500TB $0.015 $0.030 $0.030 $0.030
Next 4 PB
$0.010
Contact Us Contact Us Contact Us
Above 5 PB Contact Us Contact Us Contact Us Contact Us

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS WAF Pricing
WebACL Charges (in all available Regions)
$5 per web ACL per month
Rule Charges (in all available Regions)
$1 per rule per web ACL per month
Request Charges
AWS WAF also charges for the amount of web request AWS WAF handles. This is based
upon the number of web requests that are evaluated.
Request Charge (in all available Regions)
$0.60 per million web requests
Managed Rules From AWS Marketplace
Depends on the vendor – average $20-$30 per ACL per month + Request Charges

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
region
private subnet b
NAT Gateway
Internet
Gateway
AMI
public subnet a
Application
Load Balancer
Demo Arch
private subnet a
AMI
public subnet b
Users
Amazon
CloudFront
AWS WAF

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS WAF Security Automations

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Resources
Whitepaper: AWS Best Practices for DDoS Resiliency
https://d1.awsstatic.com/whitepapers/Security/DDoS_White_Paper.pdf
Whitepaper: Use AWS WAF to Mitigate OWASP’s Top 10 Web Application
Vulnerabilities
https://d1.awsstatic.com/whitepapers/Security/aws-waf-owasp.pdf
OWASP Top 10 (2017) – The Ten Most Critical Web Applications Security Risks
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
AWS WAF Security Automations
https://aws.amazon.com/solutions/aws-waf-security-automations/
Managed Rules for AWS WAF Application Firewall (AWS Marketplace)
https://aws.amazon.com/marketplace/solutions/security/waf-managed-rules

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you
vladsim@amazon.com