Understanding DDoS Attacks on AWS

A Distributed Denial of Service (DDoS) attack floods a target with traffic from many sources at once, aiming to exhaust its capacity so legitimate users cannot connect. Because the traffic comes from thousands of distributed hosts, you cannot simply block one IP; you must absorb or filter the flood.

Volumetric attacks aim to saturate network bandwidth with sheer volume, measured in gigabits or terabits per second. Examples include UDP floods and reflection or amplification attacks that bounce traffic off open servers (DNS, NTP) to multiply their size. These operate at Layer 3.

Protocol attacks (Layer 4) exhaust connection-state resources rather than bandwidth. A classic example is the SYN flood, which sends a storm of half-open TCP handshakes that consume the target connection table until no new sessions can be established.

Application-layer (Layer 7) attacks send many seemingly valid requests, like a flood of HTTP GETs to an expensive page, to exhaust CPU, memory, or database connections. They use far less bandwidth and blend in with real traffic, making them harder to detect than volumetric floods.

AWS absorbs DDoS at its global edge. Services like CloudFront, Route 53, and Global Accelerator run across many edge locations with enormous aggregate capacity, so floods are diluted before reaching your origin. Architecting at the edge is itself a DDoS defense.

AWS Shield Standard is enabled for all customers at no extra cost and automatically defends against the most common network and transport-layer attacks. You do not configure it; it protects every AWS resource, especially those behind edge services, against typical Layer 3 and 4 floods.

Shield Standard focuses on network and transport layers. Application-layer floods are addressed with AWS WAF rate-based rules and Shield Advanced. This is why DDoS defense combines Shield for volume with WAF for request-level filtering, a pairing the exam frequently tests.

Beyond downtime, a DDoS can drive up auto-scaling and bandwidth costs as your infrastructure tries to serve the flood. This financial impact, sometimes called economic denial of sustainability, is one reason Shield Advanced offers cost-protection credits for scaling triggered by attacks.

Signs of a DDoS include sudden traffic spikes, elevated latency, and surging error rates. CloudWatch metrics on request counts and the Shield console reveal anomalies. Shield Advanced adds near-real-time attack visibility and notifications so you know an attack is underway, not just that the app is slow.

The best DDoS posture is designed in, not bolted on. Fronting workloads with CloudFront and Route 53, using auto scaling, and minimizing the exposed surface let AWS absorb floods at the edge. Shield and WAF then handle what remains. Resilience comes from architecture plus these services together.

Next you compare Shield Standard and Shield Advanced, learn what the DDoS Response Team and cost protection add, and study how to architect for resilience. Understanding the attack types here sets up the right defense choice for each layer.

Classify the attack type.

DDoS floods a target from many sources. Volumetric (Layer 3) attacks saturate bandwidth via UDP floods and amplification; protocol (Layer 4) attacks like SYN floods exhaust connection state; application-layer (Layer 7) attacks send valid-looking requests to drain compute. AWS edge services dilute floods, Shield Standard auto-defends Layers 3 and 4, and WAF rate-based rules handle Layer 7.