DDoS Protection with AWS WAF

Basic configuration for AWS WAF, solely focused on dealing with L7 DDoS attacks. This is by no means a comprehensive WAF configuration, but it's super effective against HTTP floods.
#aws #waf #ddos

[@ianlamb1910]

Exactly what I needed, brilliant video and covers a lot of important points, thank you.

[@ianlamb1910]

Out of curiosity, say if an IP address was blocked, is that just for the 5 minute window, or does that go into a blocked ip list which is editable? The latter is very appealing to me.

[@the-aws-ninja]

The IP remain limited until it stops sending traffic for a while. The list is not editable, but you can use cli or api to list the offending IPs - docs.aws.amazon.com/waf/latest/developerguide/listing-managed-ips.html

[@ianlamb1910]

@@the-aws-ninja Great thanks are you going to do a video on setting up CloudFront for all that additional noise you spoke of here? Would love to see it.

[@solo-yl8uc]

thank you so much

[@VijayLaxmi-kv9qq]

I don't know computer knowledge,,,,, thanks lot,,,❤❤

[@jcprangue9070]

hi thanks for this video, question is this aws shield / waf apply in all ec2 servers?

[@the-aws-ninja]

You apply waf to CloudFront, alb, api gw, and a few other services. Shield is applicable to CloudFront and alb, as well as elastic IP

[@milanminchev7112]

Do I need to point the aws instance/domain somewhere after creating the rules ? I mean I have a single web apache server in aws ec2, this rules will apply automatic without pointing to the instance or I need to point this rules to the instace/domain ?

[@the-aws-ninja]

I need to attach the web acl to a CloudFront distribution or an ALB, and they should point to your instance.
If it's just a single server, CloudFront is cheaper and better in your case.

[@Achrafsouk]

How would solve the following risk with POST based rate limiting: A single IP can easily cause a denial of service to other users by POSTing beyond this limit.

[@the-aws-ninja]

Absolutely. You should always keep multiple layers of rate based rules - IP based for non Distributed attempts, and non IP based for other attacks.
You can also create, for the POST scenario, 2 rate based rules - one set as low as 100 requests per IP, scoped down to only POST requests, and another rule, set at a higher threshold, to count ALL POST requests.
Thank you for this question!

[@Achrafsouk]

Thank you for the awesome content@@the-aws-ninja

[@Kira-gc2er]

Hello i have an ec2 instance. How do i link the instance to the waf?

[@the-aws-ninja]

Either put an ALB on top of it, or better use CloudFront. Attach WAF to either ALB or CloudFront

[@RonnyPortillo]

hello! It works in Elastic Beanstalk apps?

[@the-aws-ninja]

You can certainly use WAF on top of ALB