AWS DDOS Resiliency Part 4: Application Layer Defense - Implementing WAF Rate Based Rules
A great way to protect your web application from DDoS attacks at Layer 7 is to use AWS WAF rate limiting rule . It allows you to automatically block clients from specific IP addresses that are sending abusive amount of requests to your application.
The rate-based rule keeps track of the number of requests seen per IP address based on a sliding time window of 5 minutes. The sliding window is updated every 30 seconds and once the rate limit is reached, the rule immediately takes action pertinent to the IP address. It does not wait until the 5 minutes has passed before taking the action. The rate-based rule keeps blocking requests from the offending IP address until the address lowers the rate of requests being sent from it.