How do I prepare for a DDoS fire drill with Shield Advanced?

Resolution

Prerequisites: Before you request a fire drill for DDoS protection by AWS Shield Advanced, take the following actions:

• Add your public resources to Shield Protected Resources. For fire drills, your resources can include Application Load Balancers, Classic Load Balancers, and Amazon CloudFront distributions.
• Configure Amazon CloudWatch alarms associated with DDoS metrics.
• Create Amazon Simple Notification Service (Amazon SNS) notification topics and subscribe to them.

Note: Fire drills use only synthetic data to invoke the DDOSDetected alarm. Unlike other simulation testing, fire drills don't inject real data. For more information see Understanding DDoS simulation testing in AWS.

Verify Shield Advanced Protection

To confirm that Shield Advanced protects your resources, complete the following steps:

1. Open the AWS WAF console.
2. Under AWS Shield, choose Protected Resources.
3. Confirm that your target resources are in the list of protected resources.
4. Confirm that the protection status of each resource shows Protected by Shield Advanced.
   Note: Only Shield Advanced protected resources generate DDoS detection metrics. You can protect other resource types, such as Network Load Balancers, Elastic IP addresses, or Amazon Route 53 hosted zones. However, only Application Load Balancers, Classic Load Balancers, and Amazon CloudFront distributions are compatible with fire drills.

Create SNS topics and CloudWatch alarms

Add SNS topics and alarms with the AWS WAF Console

1. Open the AWS WAF console.
2. For CloudFront global resources, switch to the US East AWS Region. For regional resources, including Application Load Balancers and Classic Load Balancers, select the Region where your resource resides.
3. Under AWS Shield, choose Protected Resources.
4. Select the resource that requires alarms.
5. Choose Edit.
6. Choose Next.
7. (Optional) If you have Amazon Route 53 health checks configured, then select the appropriate health check for your resource.
   Note: It's a best practice to use health checks for detection. Health checks improve the accuracy of network-layer, transport-layer, and web request flood detection.
8. Choose Next to continue to Create alarms and notifications.
9. Choose Create an SNS Topic.
10. Enter a Topic name.
11. Add email addresses that require notifications when resources are under attack.
12. Choose Next, and then choose Finish.

After you complete the SNS configuration, Shield creates CloudWatch alarms and the SNS topic. You cannot edit alarms directly from the Shield console. To edit alarms, see Edit or delete a CloudWatch alarm. To edit SNS topics, see Creating an Amazon SNS topic.

To find the SNS topic name, complete the following steps:

1. Open the CloudWatch console.
2. Choose CloudWatch alarm.
3. Choose Edit alarm.
4. Choose the Configure actions tab.
5. Under Send notification to, choose View the topic name.

Add alarms with the AWS CLI

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To add alarms with the AWS CLI, run the following put-metric-alarm command:

aws cloudwatch put-metric-alarm \
  --alarm-name "DDoS-Attack-Detected" \
  --namespace "AWS/DDoSProtection" \
  --metric-name "DDoSDetected" \
  --dimensions Name=ResourceArn,Value="arn:aws:elasticloadbalancing:region:123456789012:loadbalancer/app/prod-alb/abc123" \
  --statistic Sum \
  --period 60 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 1 \
  --alarm-actions "arn:aws:sns:region:123456789012:security-alerts"

Note: Replace region with your AWS Region, 123456789012 with your AWS Account ID, prod-alb with your load balancer name, and abc123 with your load balancer ID.

Follow best practices

Take the following actions to create effective alarms for incident detection:

• Create alarms for all protected resources individually.
• To simplify tracking, use descriptive alarm names that include resource identifiers.
• Set up multiple notification channels, such as email, SMS, and Slack.
• Create CloudWatch dashboards to visualize DDoS metrics across all resources.
• Test alarm notifications periodically.
• Document your alarm configuration for team reference.
  Note: Alarms initially show INSUFFICIENT_DATA, and this is expected behavior until CloudWatch accumulates data points. For more information, see How do I troubleshoot my CloudWatch alarm in the INSUFFICIENT_DATA state?

Related information

AWS Best Practices for DDoS Resiliency

Setting up AWS Shield Advanced

CloudFront - Incident Detection and Response Alarming Best Practices