- Hello everybody.
My name is Girish Keshav
and I am a solution architect at AWS.
Welcome to a short talk
on automatic application layer DDoS mitigation
with AWS Shield Advanced.
AWS Shield Advanced establishes a baseline
for all AWS WAF enabled resources
to detect layer seven attacks.
Minimum baseline time is 24 hours
after enabling Shield Advanced
and for higher accuracy
AWS recommends a 30 day baseline.
A combination of significant deviations
from this traffic baseline
and Route 53 health checks are flagged as a DDoS event.
If a DDoS event occurs,
not only one needs to manually build AWS WAF rules
that isolate the malicious traffic,
but also deploy the rules using AWS WAF console
or by using APIs.
This would be followed by
testing the rules effectiveness against the attack.
AWS Shield Advanced customers
can utilize the Shield response team
to create such AWS WAF rules or rely on their own expertise.
Overall, the process can consume time,
thereby increasing the time it takes
to mitigate a DDoS attack.
This is where automatic application layer
DDoS mitigation feature comes in handy.
Now let's take a look at how this feature works.
Automatic application layer DDoS mitigation
is a set of capabilities
included for all Shield Advanced customer.
This will enable Shield to automatically
mitigate malicious web traffic
that threatens to impact application availability.
This feature automatically checks
for attacks against normal traffic,
creates tests and deploys AWS WAF rules
to mitigate layer seven DDoS events on behalf of customers.
There is flexibility to enable this feature
in count or block mode.
Count mode enables customers to check the room groups
and rules being created during an attack
but not block traffic.
Block mode, on the other hand
will block identified malicious traffic during an attack.
Please note at the time of this recording,
automatic application layer DDoS mitigation
is available only on research type Amazon CloudFront
and application load balancer.
Now, let's see what happens during an attack.
Traffic that significantly deviates
from the established Shield Advanced baseline
will be flagged as a potential DDoS event.
After an event is detected,
AWS Shield Advanced will attempt to identify a signature
based on offending request patterns.
If a signature is identified,
AWS WAF rules will be created
to mitigate attack traffic with that signature.
The rules will then be added
to Shield-Managed rule group.
Please note that auto-mitigation rule group
requires 150 WCUs or web-based cell capacity units.
Customers can choose whether the rules are deployed
in count mode to observe and test
or block mode to block the attack.
Customers can also create CloudWatch alerts
based on when the requests are being blocked or counted.
Customers also have the option to intervene
and change the action between count or block mode
or disable the feature entirely at any given time.
Shield Advanced will automatically remove any AWS WAF rules
after it has determined that the attack has fully subsided.
With that, let me you how to enable this feature
in AWS console.
After logging into the AWS console,
search shield in the search bar
and from the dropdown click on WAF and Shield.
Before we dive into the main topic
let me quickly show you a web ACL
that I have already created for this demo,
which we will utilize
while configuring automatic mitigation feature.
On the left hand side under AWS WAF,
click on Web ACL.
Select the corresponding region
and click on the name of the web ACL.
Click on the rules tab
and as you can see I have two rules currently in place.
One is an AWS managed rule
and the second one is a rate based rule.
We will revisit this section at the end of this demo.
Let's get started
with automatic application layer DDoS mitigation.
On the left hand side expand AWS Shield
and click on getting started.
Please note, as mentioned before
to get the benefits of Shield Advanced
you must subscribe to an annual subscription.
This page displays global activity detected by AWS shield
and various other important information
related to your account.
For the purpose of this demo
we will add a new resource to be protected
with Shield Advanced.
You can also alternatively
add automatic application layer mitigations
to resources that are already protected.
Click on add resource to protect.
In the following page
select the resource type that you wish to protect.
In our case, it is application load balancer
so we will uncheck the rest of the options.
Click on load resource type.
From the list of resources
select the ALB you wish to protect.
In the next section, add any relevant tags.
Click on protect with Shield Advance to continue.
Next associate any web ACLS
that you have created for this setup.
This is where automatic application layer
mitigation rule group will be created and placed.
Please note AWS Shield will not create a web ACL
automatically during an attack.
Select the ALB
and from the drop down select the corresponding web ACL.
Any rate-based rules in the ACL
are listed here for our reference.
The next section is where we can configure
automatic application layer DDoS mitigation.
Here we are presented
with three options for automatic mitigations.
First option is keep current settings.
This option will preserve any previous settings
for automatic application layer DDoS mitigation.
The second option is enable.
This option will enable
automatic application layer DDoS mitigation.
Upon selection of this option,
an additional dropdown is presented
to choose a WAF rule action.
We can either choose count or block mode
for traffic that matches
a rule placed in automatic mitigation.
We recommend keeping rule action in count mode
until your application establishes
a consistent traffic pattern.
The third option is disable.
If already enabled,
you can disable the feature by choosing this option
while modifying a protected resource.
Note, this section can be changed at any time in future
to any of the three option even during a DDoS attack.
Click next to continue.
In the next page we can optionally configure
Route 53 health check based DDoS detection.
AWS highly recommends you to enable this feature
for additional data point to improve the accuracy
of network-layer and transport-layer
event detection and mitigation,
as well as web request flood detection.
For the purpose of this demo
I have already pre-configured a health check
and will choose it from the dropdown.
Click on next to continue.
Next section is to optionally configure SNS topic
to get notified in case of a DDoS detection
or any rate-based alarms.
For this demo, we will not set up the SNS settings.
Click next to continue.
The final section is to review all previous settings.
As we have chosen count mode
in automatic application layer DDoS mitigation,
a warning in red is shown to indicate
that this is only to monitor
and no action will be taken in case of an attack.
Click on finish configuration.
This concludes enabling automatic application layer
DDoS mitigation feature.
Finally, we can now navigate to web ACL
and check on the ACL that was associated
with application load balancer
to see that we have now an additional rule group
called shield mitigation rule group.
On the left hand side
click on web ACL to continue.
Click on the name of the web acl.
Go to the rule
and you can see that there is shield mitigation rule group
associated with web ACL.
In case of a DDoS attack
Shield Advance will automatically add rules
in count or block mode based on initial settings
into this rule group.
As and when the attack subsides
the rules are removed automatically.
Please note, a user cannot modify this rule group directly.
This concludes the control walkthrough.
Here are some best practices
for using automatic mitigation feature.
If you're using AWS Firewall Manager to centrally configure
and manage Shield and WAF security policies
across multiple accounts,
then it is recommended that
all Shield automatic mitigation features
should be configured in Firewall Manager
and not Shield Advanced directly.
If multiple endpoints are supported,
always choose the one that is first point
or parameter of the attack.
For example, if your workload involves Amazon CloudFront
and ALB, it is recommended to apply
automatic application layer DDoS mitigation feature
on CloudFront as that would be the parameter of DDoS attack.
It is recommended to test
and observe the feature in count mode
before moving it to block mode.
Do not delete shield mitigation rule group in WAF.
If you do, you disable the protection
provided by Shield Advance automatic mitigation
for every resource that is associated with the web ACL.
Lastly, enable Route 53 health checks
and set up CloudWatch alarms for efficient reporting.
Lastly, please check out the links in the video description
for further reading.
Thank you for your time
and happy cloud computing from all of us at AWS.