4 ms·

I host a high profile news site on AWS infrastructure. > The big downside of course is that the record has to be in our system in order to ALIAS to it. I need

by aleem 13y ago

I host a high profile news site on AWS infrastructure. > The big downside of course is that the record has to be in our system in order to ALIAS to it. I need DDoS protection as the site gets attacked from time to time. I went with CloudFlare since ELB doesn't say much if anything about DDoS protection. This means I can't use Route53 and so I cannot work around apex issues and I can't point my apex to ELB either. The suggested work around I keep coming across is to poll the ELB IP and update it at CloudFlare via an API though I am not sure how good that would work if someone cached the IPs for whatever reason (even though ELB will honor requests up to one hour after the IP change I read somewhere else). Do you have any suggestions either for DDoS mitigation or finding a work around to my apex woes?

colmmacc 13y ago
We've opened up a little lately, and some of our DDOS mitigation details are now available in my colleague Nate's talk from Re:Invent: www.youtube.com/watch?v=V7vTPlV8P3U . What I can repeat from that talk is that we've handled DDOS attacks in the same orders of magnitude that are as large as anything else we've ever heard, that we use them ourselves for our own services. We'd certainly be interested in a conversation about your needs, attacks you've experienced, and how we can meet them. (e-mail: colmmacc@amazon.com). ELB is a multi-IP service and can dynamically scale from 1 to ~100 IPs. In general, when scaling down, IPs are retired from DNS but aren't removed from an ELB until we've seen traffic drain (which would explain the hour, but it's variable). If you want to know all of the IPs for an ELB, you can query; all.[elb-name].[region].elb.amazonaws.com all.ipv6.[elb-name].[region].elb.amazonaws.com and you'll get them all. Though we strongly recommend against CNAMEing to those names directly, it can useful if you need the scrape the IPs systematically for some reason (and it sounds like this might be such a case). I'm not sure what other workarounds may be available via CloudFlare.

by aleem 13y ago

colmmacc 13y ago

We've opened up a little lately, and some of our DDOS mitigation details are now available in my colleague Nate's talk from Re:Invent: www.youtube.com/watch?v=V7vTPlV8P3U . What I can repeat from that talk is that we've handled DDOS attacks in the same orders of magnitude that are as large as anything else we've ever heard, that we use them ourselves for our own services. We'd certainly be interested in a conversation about your needs, attacks you've experienced, and how we can meet them. (e-mail: colmmacc@amazon.com). ELB is a multi-IP service and can dynamically scale from 1 to ~100 IPs. In general, when scaling down, IPs are retired from DNS but aren't removed from an ELB until we've seen traffic drain (which would explain the hour, but it's variable). If you want to know all of the IPs for an ELB, you can query; all.[elb-name].[region].elb.amazonaws.com all.ipv6.[elb-name].[region].elb.amazonaws.com and you'll get them all. Though we strongly recommend against CNAMEing to those names directly, it can useful if you need the scrape the IPs systematically for some reason (and it sounds like this might be such a case). I'm not sure what other workarounds may be available via CloudFlare.