Are Lightsail instances protected against DDOS by default using AWS Shield Standard ?

Question

Hello

Is my Lightsail instance protected against DDOS by default using AWS Shield Standard ?

Or do I need to setup something for AWS Shield Standard to protect my Lightsail instance against DDOS ?

Accepted Answer

Yes Lightsail has some protection from L3/4 attacks by default from Shield Standard,  however having EC2 instances directly exposed to the internet is not well-architected.  In order to protect against layer 7 attacks you would need to front your Lightsail instance with a self-managed ALB or CloudFront distribution with a well-configured AWS WAF WebACL associated.

While Shield Advanced offers many benefits,  the $3K per-month subscription cost does not make sense for all customers.

Please look at [AWS Best Practices for DDoS Resiliency](https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/aws-best-practices-ddos-resiliency.html) for more information on being well-architected and configuring useful AWS WAF rules to prevent malicious traffic from reaching your servers.

Answer

As AWS Shield Standard protects at level 3 and 4, Lightsail would be protected. But what application is running on your Lightsail server? Would that benefit from level 7 protection?
What other services you want to delete from your wishlist?
- additional detection and mitigation against large and sophisticated DDoS attacks
- near real-time visibility into attacks
- integration with AWS WAF
- protection against DDoS-related spikes 
- region- and resource-specific monitoring techniques
- 24/7 access to the Shield Response Team

My 2ct: unless 100% sure basic protection will do and/or you can survive outages, use the Advanced version by default.

Rgds, Henk

Answer

https://www.google.com/search?client=firefox-b-d&q=aws+lightsail++ddos
**No DDoS protection by default** (but snapshots are available for a fee).

Are Lightsail instances protected against DDOS by default using AWS Shield Standard ?

相關內容