So here is a lecture
that is more focused on solution architecture,
and this is around DDoS protection and best practices.
So let's assume that you have this kind of architecture,
we have an Auto Scaling Group with EC2 instances.
It's fronted by an Elastic Load Balancer,
and then your load balancer can be either exposed
by a global accelerator, as fixed IPs,
or it can be fronted, for example, by CloudFront.
CloudFront can be linked to a WAF,
a Web Application Firewall, and so on.
You can have Route 53 for DNS routing.
And finally, you could also have another architecture
where you have CloudFront and the API Gateway.
So this is just to represent
the kind of combinations you can do.
Obviously, there are more than one.
But the idea is that we're going to discuss,
thanks to the letter BP1,
Best Practice 1, Best Practice 2, et cetera.
what the implications are
in terms of DDoS resiliency, okay?
So by using CloudFront, we are actually at the edge.
So this slide is all about edge location mitigation.
That means that your web application delivery
is at the edge,
and so you're going to be protected
against DDoS Common Attacks by using Shield,
just a normal setup of Shield,
so SYN floods and UDP reflection.
If you use the Global Accelerator,
it's going to be able to access your application
around the world, again, at the edge.
And again, it's fully integrated with Shield
for DDoS protection.
So it's very helpful if your backend
is somehow not compatible with CloudFront.
In this case, you would have Global Accelerator
in front of it.
And so that means that no matter what backend you have,
you're either using CloudFront or Global Accelerator,
you will be fully distributed at the edge of AWS
and the edge location will be DDoS protected.
Also, if you use Route 53,
then the Domain Name Resolution is global.
It's at the edge,
and you also have a DDoS Protection mechanism on your DNS.
So we understand that if we're at the edge,
we can have a better DDoS protection.
Next, we can have the best practices for DDoS mitigation.
So first let's look at the infrastructure layer defense.
This is BP1, BP3, and BP6.
So the idea is that by using CloudFront, Global Accelerator,
Route 53, and the Elastic Load Balancing,
we protect our Amazon EC2 instances against high traffic.
And this is the idea that by using all these services,
the traffic is going to be handled by most of them
before ever reaching our EC2 instances.
Now if we enable our EC2 instances with Auto Scaling,
that means that in case the traffic
does indeed reach our Auto Scaling group,
we can scale automatically
to accommodate for a greater load on our application.
And if we use Elastic Load Balancing,
then the ELB is going to automatically spread the traffic
across many EC2 instances.
So that means that EC2 instances
will have a manageable amount of traffic onto them
provided the fact that the Auto Scaling Group, of course,
has scaled as well.
Now at the Application Layer Defense,
we can detect and filter malicious requests at BP1 and BP2.
So the idea is that CloudFront
is going to serve static content
and serve it from edge locations,
therefore protecting your backend.
And then you can use WAF on top of CloudFront
or your Application Load Balancers
to filter and block requests based on request signatures.
For example, you can block specific IPs,
specific request types, and so on.
And if you use the WAF rate-based rules,
you can automatically block the IPs of bad actors.
So you can use a bunch of managed rules on WAF
to block IPs based on reputation or block anonymous IPs
and so on.
And using CloudFront, you can block specific geographies.
The idea is that CloudFront and WAF are managed services,
and so they will take care
of filtering some requests for you
so you can be protected against DDoS attack.
And, of course, using Shield Advanced,
so in case you enable it,
then it will automatically create WAF rules for you
to mitigate layer 7 attacks.
So this is good for the Application Layer Defense,
again, to protect your EC2 instances
from getting any bad requests
or at least minimize them.
And also, how do we reduce our attack surface?
So the idea with this architecture
is that the backend AWS resources
that are used to serve our application are hidden.
So we have BP1, BP4, and BP6.
So if you use CloudFront, the API Gateway,
or Elastic Load Balancing,
we can hide our backend resources.
The attacker will never know
if it's a Lambda function or EC2 instances or ECS tasks
and so on,
because we have used other things in front of them.
Also, we can set up security groups and Network ACLs
to filter traffic based on specific IPs.
And Elastic IPs, if we use them,
they can be protected by AWS Shield Advanced as well.
And then you can protect API endpoints themselves.
So if you use the API Gateway,
then you can hide whatever backend it is,
whether it be EC2, Lambda, or something else.
And if you use the edge-optimized mode,
you're already global.
Otherwise, you can use CloudFront plus the regional mode
which gives you more control for DDoS protection.
And if you use WAF on top of the API Gateway,
then you can get filtering of any HTTP request.
And if you set up the API Gateway correctly,
you can have burst limits,
you can do headers filtering,
and you can use and force API keys for your users,
therefore protecting yourself from a DDoS attack.
So hopefully, this kind of architecture makes sense
and you understand the different ways
you can protect against DDoS,
because the exam will ask you to think just like that, okay?
So that's it for this lecture.
I hope you liked it,
and I will see you in the next lecture.