search

amazon-archives / aws-waf-sample

This repository contains example scripts and sets of rules for the AWS WAF service. Please be aware that the applicability of these examples to specific workloads may vary.
MIT No Attribution
512 stars 235 forks source link

Delay Blocked IP Address (DDOS) #28

Open levilugato opened 5 years ago

levilugato commented 5 years ago

Is it possible to immediate block IP when receive attacks (DDOS)? Apparently S3 has a lag to record a log list.

hugobcar commented 5 years ago

Yes, really.

that some or all log file entries for a time period can sometimes be delayed by up to 24 hours https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#access-logs-timing

In the beginning of the year, I develop this solution for this problem: https://engineering.contaazul.com/instant-block-of-attacks-to-aws-websites-using-cloudfront-lambda-edge-dynamodb-waf-a94281cb5bde