Configuration required to enable automatic mitigation - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced

Configuration required to enable automatic mitigation

You enable Shield Advanced automatic mitigation as part of the application layer DDoS protections for your resource. For information about doing this through the console, see Configure application layer DDoS protections.

The automatic mitigation functionality requires you to do the following:

  • Associate a web ACL with the resource – This is required for any Shield Advanced application layer protection. You can use the same web ACL for multiple resources. We recommend doing this only for resources that have similar traffic. For information about web ACLs, including the requirements for using them with multiple resources, see How AWS WAF works.

  • Enable and configure Shield Advanced automatic application layer DDoS mitigation – When you enable this, you specify whether you want Shield Advanced to automatically block or count web requests that it determines to be part of a DDoS attack. Shield Advanced adds a rule group to the associated web ACL and uses it to dynamically manage its response to DDoS attacks on the resource. For information about the rule action options, see Rule action.

  • (Optional, but recommended) Add a rate-based rule to the web ACL – By default, the rate-based rule provides your resource with basic protection against DDoS attacks by preventing any individual IP address from sending too many requests in a short time. For information about rate-based rules, including custom request aggregation options and examples, see Rate-based rule statement.