Narrator: Now let's talk about
how we can protect ourselves from a DDoS attack.
A DDoS attack is a Distributed Denial-of-Service attack
on our infrastructure
and we'll see how this works.
So say there's an attacker,
that's a hacker
and they want to do a DDoS attack
against our application server.
In this case they're going to launch multiple master servers
and these servers are going to launch bots,
a lot of bots
and all these bots
are going to send a request to our application server.
Now our server is not meant
to handle this many requests
so it will be overwhelmed
and it will not be working anymore,
he will be denied a service
and therefore any normal user trying to connect
to our application server,
will see that our server is not accessible
or not responsive,
effectively making our application down.
So a DDoS attack is quite scary
when you think about it
but on AWS
you can protect yourself from it.
The first way is to use AWS Shield Standard
and that's enabled for all customers at no additional cost
and it will protect you against a DDoS attack
for your websites and application.
If you want a premium DDoS protection,
you have to use AWS Shield Advanced
which is going to give you 24/7
so 24 hours a day,
seven days a week protection on DDoS.
Then you have WAF
to filter specific requests based on rules,
this is the web application firewall.
CloudFront and Route 53 that we've already seen
to give us protection by using the global edge network
and so when it's combined with Shield
it will provide attack mitigation at the edge locations
and finally you need to be ready to scale
if you're under attack
maybe by leveraging auto scaling on AWS.
So here is what the sample reference architecture
looks like for DDoS protection.
So we have our users
and they will be routed through the DNS on Route 53
which is protected by shield
so your DNS is safe from DDoS attack,
then you should use a CloudFront distribution
to make sure your content is cached at the edge
and then it is also protected by shield
and in case you need to filter
and protect from an attack,
you can use the web application firewall,
then to serve that application
you can use a load balancer in the public subnet
that will scale for you
and finally behind the load balancer
you should use EC2 instances
in an auto scaling group
to be able to scale to the higher demand.
So all of this will give you a really good DDoS protection
against these type of attacks.
Now let's do a deep dive into the services
that I just mentioned.
So Shield is made up of two components,
we have Shield Standard
which is a free service
that is activated for every AWS customer
and this will provide you
protection against the common attacks for DDoS,
they're called SYN/UDP Reflection Floods,
Reflection attacks
and other layer three or layer four attacks.
Then you have Shield Advanced
which is an optional service,
it cost you about $3000 per month per organization
and they will give you protection
against more sophisticated attacks
on your EC2, ELB, CloudFront, Global Accelerator
and Route 53.
You also get access to your response team
when you need it
to help you protect yourself
during these DDoS attacks
and in case you are incurring some costs
on these attacks,
then any fees that is incurred during this attack
is on AWS.
So Shield from an exam perspective
remember that the free version
is activated by default for every customer
and if you need that response team
if you need to be having a higher level of defense
then Shield Advanced
is something that you enable yourself
and it cost about $3000 per month.
Next we have the Web Application Firewall, so WAF
and this is to protect your web applications
from common web exploits,
for example on layer seven.
Layer seven as you remember
maybe is HTTP
whereas layer four was for TCP.
So because it is layer seven
it can be deployed only on HTTP friendly devices
so it can be deployed on your application load balancer
your API gateway we haven't seen it,
it's out of scope for the exam
and CloudFronts.
On your web application firewall
you can define Web ACL
so Web Access Control Lists
and these rules on this ACL
can include filtering for example
based on the IP addresses,
the headers of HTTP,
the body, some strings
it can protect you against common attacks
such as a SQL injection
or Cross-Site Scripting.
You can have size constraints
to make sure the requests are not too big
and also block certain countries using a geo-match.
Finally for DDoS protection
you can use Rate-based rules
to count the occurrences of events,
therefore saying that
you know a user cannot do
more than five requests per second
and that would help to be protected against a DDoS attack.
So that's it's,
just at a high level remember
that it is a combination of
Shield, WAF, CloudFront, Route 53
they will give you an entire DDoS protection
and again all these service you need to them
at a high level.
So hope that was helpful
and I will see you in the next lecture.