Module 8: High Availability & DDoS Protection

Advanced Architecting on AWS

Route 53 • Global Accelerator • Shield • WAF • Multi-Region

🎯 Module Objectives

Design multi-region failover with Route 53 health checks
Implement AWS Global Accelerator for performance and availability
Configure AWS Shield Standard and Advanced for DDoS protection
Deploy AWS WAF rules and managed rule groups
Understand L7 DDoS automatic mitigation (NEW)

🌐 Route 53 Failover Architecture

Health Checks: Monitor endpoints (HTTP/HTTPS/TCP), calculated health checks, CloudWatch alarms
Failover Routing: Primary/secondary — auto-switch when primary fails health check
Latency Routing: Route to lowest-latency region for the user
Geolocation/Geoproximity: Route based on user location or bias
Multivalue Answer: Return up to 8 healthy records (simple load distribution)

Pattern: Active-passive: Failover routing with health checks. Active-active: Latency routing with health checks in both regions. Route 53 is the traffic director.

🚀 AWS Global Accelerator

Feature	Global Accelerator	CloudFront
Protocol	TCP/UDP (any protocol)	HTTP/HTTPS (web content)
Caching	No caching	Edge caching
Use case	Gaming, IoT, VoIP, non-HTTP apps	Web apps, APIs, static content
Static IPs	2 anycast IPs (fixed)	Varies by edge location
Health checks	Yes — automatic failover	Origin failover groups
Performance	AWS backbone from nearest edge	AWS backbone + caching

When to use: Non-HTTP workloads or when you need static IP addresses for whitelisting → Global Accelerator. Cacheable web content → CloudFront.

🛡️ AWS Shield

Shield Standard (Free)

Automatic protection against L3/L4 DDoS. Included for all AWS customers. Protects against SYN floods, UDP reflection, etc.

Shield Advanced ($3,000/mo)

24/7 DDoS Response Team (DRT). Cost protection (refund scaling costs). Advanced metrics. L7 detection. WAF included at no extra cost.

Protected resources: CloudFront, ALB, NLB, Elastic IP, Global Accelerator, Route 53
DRT engagement: AWS experts assist during active attacks (Shield Advanced only)

🔥 AWS WAF

Web ACLs: Collection of rules evaluated in priority order
Rule types: Rate-based, IP set, geo match, regex, SQL injection, XSS
Managed Rule Groups: AWS-maintained (Core rule set, SQL injection, Known bad inputs, Bot Control)
Custom rules: Match conditions on headers, body, query strings, URI path
Actions: Allow, Block, Count, CAPTCHA, Challenge

NEW (2025): WAF L7 DDoS Managed Rules — Firewall Manager can now automatically deploy managed rules that detect and mitigate application-layer DDoS attacks. No manual rule writing needed for common L7 attack patterns.

🌍 Multi-Region HA Patterns

Active-Passive

Primary region handles all traffic. Secondary on standby. Route 53 failover routing. RPO: minutes. RTO: minutes.

Active-Active

Both regions serve traffic. Latency-based routing. DynamoDB Global Tables for data. RPO: near-zero. RTO: near-zero.

Pilot Light

Core services always running (DB replicas). Scale up compute on failover. Lower cost than full standby.

Warm Standby

Scaled-down copy in secondary region. Scale up on failover. Balance of cost and recovery speed.

💻 Demo: WAF Rule Configuration

# Create a rate-based rule (block if >2000 requests/5min)
aws wafv2 create-rule-group --name rate-limit --scope REGIONAL \
  --capacity 10 --rules '[{"Name":"RateLimit","Priority":1,
  "Statement":{"RateBasedStatement":{"Limit":2000,"AggregateKeyType":"IP"}},
  "Action":{"Block":{}},"VisibilityConfig":{...}}]'

# List managed rule groups
aws wafv2 list-available-managed-rule-groups --scope REGIONAL

# Associate WAF Web ACL with ALB
aws wafv2 associate-web-acl --web-acl-arn arn:aws:wafv2:... \
  --resource-arn arn:aws:elasticloadbalancing:...

🧪 Knowledge Check

Q1: A company experiences a large volumetric DDoS attack on their CloudFront distribution. They want AWS experts to help mitigate and protect against scaling cost spikes. What do they need?

A) Shield Standard + WAF B) Shield Advanced C) GuardDuty D) AWS Firewall Manager only

B) Shield Advanced — Shield Advanced provides DDoS Response Team (DRT) access, cost protection during attacks, and advanced detection. Shield Standard only provides basic L3/L4 protection without expert support.

Q2: A gaming company needs static IP addresses for their real-time UDP-based game servers while routing players to the nearest region. What should they use?

A) CloudFront B) Route 53 latency routing C) AWS Global Accelerator D) ALB

C) AWS Global Accelerator — Global Accelerator supports TCP and UDP, provides 2 static anycast IPs, routes via AWS backbone to the nearest healthy endpoint. CloudFront is HTTP-only and doesn't support UDP.

📝 Module 8 Summary

Route 53

Failover, latency, geolocation routing. Health checks drive automatic failover. Multi-region DNS.

Shield & WAF

Shield Standard (free L3/L4). Shield Advanced ($3K/mo, DRT, cost protection). WAF: managed + custom rules.

Global Accelerator

TCP/UDP anycast. 2 static IPs. AWS backbone routing. Health-check failover. Non-HTTP workloads.

Multi-Region

Active-active, active-passive, pilot light, warm standby. Choose based on RPO/RTO/cost trade-offs.