Does VPC isolate DDoS attack?

Question

There could be several circumstances to discuss:

Q1. EC2 A in VPC1 &  EC2 B in VPC2 (no matter from the same account or not): If EC2 A is under a DDoS attack that fills up all the network bandwidth the VPC1 has, will that DDoS possibly also have some bad impacts on EC2 B from VPC2? (RTT latency spike, or packet loss whatsoever)

Q2. EC2 A & EC2 B in the same VPC but different AZ: If EC2 A is under a DDoS attack that fills up all the network bandwidth the VPC has, will that DDoS possibly also have some bad impacts on EC2 B? (RTT latency spike, or packet loss whatsoever)

Q3. EC2 A & EC2 B in the same VPC also the same AZ: If EC2 A is under a DDoS attack that fills up all the network bandwidth the VPC has, will that DDoS possibly also have some bad impacts on EC2 B? (RTT latency spike, or packet loss whatsoever)

Thank you very much :-)

Brettski-AWS · Accepted Answer

Turning this around a little: It isn't about the bandwidth limit within the VPC; it is the bandwidth limit on each instance that is the thing to watch. In general, there is no limit on the amount of bandwidth within a VPC.

Check out the [EC2 instance specifications](https://aws.amazon.com/ec2/instance-types/) - there you'll see that each instance type has specific bandwidth limits.

If an instance is experiencing a high volume of traffic then the ability of that instance to communicate with anything else (other instances; other hosts outside AWS)  will likely be impacted.

To answer the questions more specifically:
1. No, but if instance B is dependent on instance A to perform its task(s) then there will be an impact but it is not a direct impact, only a consequence of not being able to communicate in a timely manner with instance A. The instance bandwidth available to instance A is separate to that available to instance B.
2. See (1).
3. See (1).

Joanna K · Answer

Just adding some additional context - the ***potential*** for 'nosy neighbor' impact exists in any multi-tenanted environment,  however AWS has protections at both the internet network border ([Shield standard](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-standard-summary.html)) and in the EC2 border (for east-west traffic) to mitigate such impact.

Does VPC isolate DDoS attack?

Add your answer

Relevant content