Web application delivery at the edge (BP1) - AWS Best Practices for DDoS Resiliency

Web application delivery at the edge (BP1)

Amazon CloudFront is a service that can be used to deliver your entire website including static, dynamic, streaming, and interactive content. Persistent connections and variable time-to-live (TTL) settings can be used to offload traffic from your origin, even if you are not serving cacheable content. Use of these CloudFront features reduces the number of requests and TCP connections back to your origin, helping protect your web application from HTTP floods.

CloudFront only accepts well-formed connections, which helps prevent many common DDoS attacks, such as SYN floods and UDP reflection attacks, from reaching your origin. DDoS attacks are also geographically isolated close to the source, which prevents the traffic from impacting other locations. These capabilities can greatly improve your ability to continue serving traffic to users during large DDoS attacks. You can use CloudFront to protect an origin on AWS or elsewhere on the internet.

If you’re using Amazon Simple Storage Service (Amazon S3) to serve static content on the internet, AWS recommends you use Amazon CloudFront to protect your bucket providing the following benefits:

  • Restricts access to the Amazon S3 bucket so that it's not publicly accessible.

  • Makes sure that viewers (users) can access the content in the bucket only through the specified CloudFront distribution—that is, prevents them from accessing the content directly from the bucket, or through an unintended CloudFront distribution.

To achieve this, configure CloudFront to send authenticated requests to Amazon S3, and configure Amazon S3 to only allow access to authenticated requests from CloudFront. CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). We recommend using OAC because it supports:

  • All Amazon S3 buckets in all AWS Regions, including opt-in Regions launched after December 2022

  • Amazon S3 server-side encryption with AWS KMS (SSE-KMS)

  • Dynamic requests (PUT and DELETE) to Amazon S3

For more information about OAC and OAI, refer to Restricting access to Amazon S3 origin.

For more information about protecting and optimizing the performance of web applications with Amazon CloudFront, refer to Getting Started with Amazon CloudFront.