Step-by-step: Setting up auto-scaling for origin under layer 7 attacks.

You're asking for trouble if your origin can't scale under a layer 7 flood. I see too many setups with a beefy, static origin server behind a WAF/CDN. When the attack bypasses the edge, your app dies and your AWS bill still spikes from the traffic transfer. The goal is to survive and keep costs from exploding.

Here's a practical, cost-aware setup using AWS primitives. This assumes you're already behind CloudFront or a similar proxy.

**Core Components:**
* **Application Load Balancer (ALB):** Non-negotiable. It's your scaling anchor.
* **Auto Scaling Group (ASG):** With scaling policies based on **RequestCountPerTarget**, not CPU.
* **EC2 Launch Template:** Using lean, pre-baked AMIs. No fat images.

**Critical Scaling Policy (CloudWatch Alarm):**
A layer 7 attack means HTTP requests. CPU might lag. Scale on the ALB metric.

```json
{
"AlarmName": "High-Request-Rate-Per-Instance",
"MetricName": "RequestCountPerTarget",
"Namespace": "AWS/ApplicationELB",
"Statistic": "Sum",
"Period": 60,
"EvaluationPeriods": 2,
"Threshold": 1000, // Tune this for your app's capacity
"ComparisonOperator": "GreaterThanThreshold",
"AlarmActions": ["arn:aws:autoscaling:...:policy/scale-out"]
}
```

**Cost-Saving Must-Dos:**
* **Use Spot Instances for the ASG mixed instances policy.** For a stateless app under attack, Spot handles the surge. Blend with On-Demand if you're risk-averse.
* **Set aggressive scale-in policies.** Once the attack stops, you don't need 100 instances idling. But use a longer cooldown to avoid thrashing.
* **ALB is expensive per LCU.** Monitor your `ActiveConnectionCount` and `NewConnectionCount` during attacks. If connections are high, consider scaling up instance size (fewer, larger instances) to reduce ALB cost, not just instance count.

**The Caveat:**
This keeps you alive, but it's still a financial hit. You're paying for the scaled-out EC2, ALB LCUs, and data transfer. The real solution is to stop the attack at the edge. This is your last line of defense. Pair this with WAF rate-based rules and geo-blocking to reduce the scaling load.