Hi everyone,
I’ve been knee-deep in architecting a secure, automated infrastructure on AWS for our 100-user SaaS startup, and I’ve hit the classic scaling crossroads: DDoS protection. While we're not a huge target, a simple volumetric attack could wipe out our EC2 instances and ELB, and application-layer attacks could sneak past. I want to get this right *before* we need it.
I've been evaluating the landscape and have my notes, but I'd love this community's real-world experience. My primary goal is effective, automated mitigation that doesn't break the bank or add massive latency. I'm comfortable with Terraform for provisioning and Ansible for config, so I'm leaning towards solutions that can be managed as code.
Here's my current shortlist and the specific trade-offs I'm pondering:
* **AWS Shield (Advanced vs Standard):** Standard is free with CloudFront and ALB, but it's mostly basic SYN/UDP flood protection. Advanced adds always-on detection, 24/7 support, and cost protection for EC2, ELB, CloudFront, and Global Accelerator. The ~$3,000/month commitment for Advanced is steep for our size, but the integration is seamless.
* **Cloudflare Pro/Business:** The "proxy-everything-through-their-network" model. WAF and DDoS are bundled. I like their rule sets and the ability to manage everything via Terraform. The main concern is latency for our API (though Argo Smart Routing looks interesting) and having all traffic routed through a third party.
* **Agnostic/Edge Providers (e.g., Akamai, Imperva):** Potentially the most robust, but historically complex and expensive. I'm unsure if the overhead is justified at our scale.
* **DIY with AWS WAF + Lambda + GuardDuty?** This is the tinkerer in me speaking. We could set up custom rate-based rules in AWS WAF, use Lambda@Edge to analyze patterns, and feed logs to GuardDuty. It's the most "Infrastructure as Code" friendly but also risks being a time sink and possibly less effective under a real, sophisticated attack.
My core technical requirements are:
1. **Automation:** Must be provisionable and tunable via Terraform/Ansible. I don't want to click in a portal during an incident.
2. **Layer 7 Focus:** While volumetric is scary, business logic attacks on our API are my bigger worry.
3. **Cost Predictability:** No surprise $10k bills because an attack blew through our data transfer.
4. **False Positive Management:** Easy to whitelist our CI/CD IPs and trusted partners.
For context, our stack is mostly ECS Fargate behind an Application Load Balancer, with CloudFront in front for static assets. All infra is defined in Terraform.
Has anyone here been through a similar decision for a startup of this size? I'm particularly interested in:
* Real-world false-positive stories with automated rule sets.
* Any clever Terraform modules or Ansible roles you've used to manage these services.
* Whether the "origin protection" mode in services like Cloudflare is viable, or if we must commit to full proxy.
* If you've successfully built a robust DIY system, what does your monitoring and response playbook look like?
Thanks in advance for sharing your wisdom. This feels like one of those foundational choices that's easy to overlook until it's too late.
—John
Keep it simple.