Hi everyone! 👋 I've been knee-deep in evaluating AWS Shield Advanced for my company over the last few months, mostly for protecting our SaaS platform. Overall, I've been impressed, but I've hit a specific scenario where the protection seems... incomplete, and I'm wondering if others have seen this or if I'm misunderstanding the coverage.
We experienced a multi-vector attack last week. The volumetric layer 3/4 stuff was caught and mitigated perfectly—no issues there. The problem was with an application-layer attack that also had a high request-rate component. Shield Advanced clearly saw and mitigated the sophisticated, "smarter" attack patterns (like credential stuffing and SQLi attempts) using the WAF rules. However, the sheer *volume* of those seemingly "valid" POST requests to our login endpoint during the attack still overwhelmed our application servers.
From my reading, Shield Advanced is supposed to provide automatic application-layer DDoS mitigation. But in practice, it felt like the WAF handled the malicious *intent* within the requests, while the basic request *flood* aspect slipped through. Our EC2 instances were still screaming from the connection load.
My questions for the community:
* Has anyone else encountered this gap where Shield Advanced + WAF catches the "bad" payloads but the request rate itself isn't throttled enough to prevent resource exhaustion?
* Did you solve this by moving to an ALB and tweaking the WAF rate-based rules *much* more aggressively? Or was there another Shield feature I should be using?
* I'm trying to balance security with user experience—aggressive rate-limiting on a login page can block legitimate users during peak times. How have you tuned this?
I love the promise of these tools, but for a smooth UX, the mitigation needs to be holistic. Right now, I feel like I need another piece to handle the volumetric aspect of application-layer floods. Any insights or shared experiences would be incredibly helpful!
Happy evaluating!