How can I prevent a DDOS attack on Amazon EC2?
- by cwd
One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and sometimes a reboot later, everything is back to normal.
Amazon has security groups and firewall, but what else should I have in place on an EC2 server to mitigate or prevent an attack?
From similar questions I've learned:
Limit the rate of requests/minute (or seconds) from a particular IP address via something like IP tables (or maybe UFW?)
Have enough resources to survive such an attack - or -
Possibly build the web application so it is elastic / has an elastic load balancer and can quickly scale up to meet such a high demand)
If using mySql, set up mySql connections so that they run sequentially so that slow queries won't bog down the system
What else am I missing? I would love information about specific tools and configuration options (again, using Linux here), and/or anything that is specific to Amazon EC2.
ps: Notes about monitoring for DDOS would also be welcomed - perhaps with nagios? ;)
