AWS Best Practices for DDoS Resiliency

Introduction 5 Denial of Service Attacks 5 Infrastructure Layer Attacks 7 UDP Reflection Attacks 7 SYN Flood Attacks 8 Application Layer Attacks 9 Mitigation Techniques 11 Best Practices for DDoS Mitigation 15 Infrastructure Layer Defense (BP1, BP3, BP6, BP7) 15 Amazon EC2 with Auto Scaling (BP7) 16 Elastic Load Balancing (BP6) 17 Leverage AWS Edge Locations for Scale (BP1, BP3) 17 Web Application Delivery at the Edge (BP1) 18 Protect network traffic further from your origin using AWS Global Accelerator (BP1) 18 Domain Name Resolution at the Edge (BP3) 19 Application Layer Defense (BP1, BP2) 20 Detect and Filter Malicious Web Requests (BP1, BP2) 20 Attack Surface Reduction 22 Obfuscating AWS Resources (BP1, BP4, BP5) 22 Security Groups and Network Access Control Lists (Network ACLs) (BP5) 23 Protecting Your Origin (BP1, BP5) 24 Protecting API Endpoints (BP4) 24 Operational Techniques 25 Visibility 25 Visibility and protection management across multiple accounts 31 Support 32 Conclusion 34 Contributors 34 Further Reading 34 Document revisions 35