Cloud Architecture

Multi-Layer DDoS Defense on AWS

Cloud Architecture diagram · made in Skemio

DDoS mitigation architecture flow showing incoming traffic filtered by AWS Shield and CloudFront, inspected by WAF, and forwarded to an internal ALB.
DDoS mitigation architecture flow showing incoming traffic filtered by AWS Shield and CloudFront, inspected by WAF, and forwarded to an internal ALB.
Open it in SkemioMake your own

What it shows

  • CloudFront and Shield Standard absorb Layer 3 and 4 floods at edge PoPs.
  • AWS WAF evaluates Layer 7 rate limits and executes JS bot challenge rules.
  • Shield Advanced adds automatic Route 53 health routing and 24/7 SRT support.

The takeaway

Absorb Layer 3 and 4 floods at edge locations and inspect Layer 7 traffic before it hits origins.

More cloud architecture diagrams