How to Protect Your Web Application Against DDoS Attacks by Using Amazon Route 53 and an External Content Delivery Network

Distributed Denial of Service (DDoS) attacks are attempts by
means of a malicious actor to flood a network, system, or software with extra
visitors, connections, or requests than it could manage. To defend your web
software towards DDoS attacks, you may use AWS Shield, a DDoS safety service
that AWS routinely provides to all AWS customers at no extra value. You can use
AWS Shield along side DDoS-resistant internet services along with Amazon
CloudFront and Amazon Route fifty three to improve your ability to guard in
opposition to DDoS assaults. Learn greater about architecture for DDoS
resiliency with the aid of reading the AWS Best Practices for DDoS Resiliency
whitepaper.
You also have the choice of using Route fifty three with an
externally hosted content material delivery community (CDN). In this blog
publish, I display how you may assist guard the top sector (additionally known
as the basis domain) of your web software by means of the usage of Route fifty
three to carry out relaxed redirection to save you discovery of the beginning
of your utility. .
Background
When surfing the Internet, a user would possibly kind
instance.Com as opposed to www.Instance.Com. To make sure that these requests
are routed correctly, it is essential to create a fixed of Route 53 alias
useful resource facts for the apex of the area. For instance.Com might be a set
of alias aid facts with out a subdomain (www) described. With Route 53, you may
use an alias aid report set to factor www or your area apex at once to a
CloudFront distribution. Therefore, all people resolving instance.Com or
www.Example.Com will simplest see the CloudFront distribution. This makes it
tough for a malicious actor to locate and assault the supply of your utility.
You can also use Route 53 to path your give up customers to
a CDN outside of AWS. The CDN provider will require you to create a set of
CNAME alias useful resource statistics to factor www.Instance.Com to the
hostname of your CDN distribution. Unfortunately, it isn't always feasible to
point your region vertex with a CNAME alias aid document set because a quarter
vertex can't be a CNAME. Therefore, customers typing example.Com with out www
will no longer be routed on your net application unless you factor the top of
the container without delay to the beginning of your application.
The benefit of a comfortable redirect from the top of the
region to www is that it facilitates defend your origin from direct assaults.
Solution Overview
The following solution diagram indicates the AWS services
this answer uses and how it uses them.
Diagram displaying how AWS offerings are used in the
solution in this newsletter
Here's how the method works:
A consumer's browser sends a DNS question to Route 53.
Route fifty three has a hosted quarter for the instance.Com
domain.
The hosted zone serves the document:
If the request is for the apex quarter, the alias useful
resource document set for the CloudFront distribution is served.
If the request is for the www subdomain, the CNAME of the
externally hosted CDN is delivered.
CloudFront forwards the request to Amazon S3.
S3 plays a comfortable redirect from example.Com to
www.Example.Com.
Note: All solution steps in this blog post use example.Com
because the area call. You ought to update this domain name with your personal
domain call.
AWS services used in this solution
You will use three AWS services on this academic to create
your CDN area shipping switch to outside apex:
Route fifty three – This article assumes you're already
using Route fifty three to direction users in your web application, giving you
safety against not unusual DDoS attacks, along with DNS query flooding. For
extra data approximately migrating to Route fifty three, see Getting Started
with Amazon Route 53.
S3 – S3 is item storage with a easy internet service
interface to store and retrieve any amount of facts from anywhere at the
internet. S3 additionally helps you to installation a repository for website
hosting websites. In this academic, you will use S3's website hosting
characteristic to redirect users from instance.Com to www.Example.Com, which
points in your externally hosted CDN.
CloudFront – When designing your utility for DDoS
resiliency, it is critical to protect foundation sources, such as S3 buckets,
from discovery by way of a malicious actor. This is called obfuscation. In this
academic, you'll use a