I run one of the largest legal bitcoin gambling sites (name in profile if interested) and was recently extorted for a whole week by DDoS's unless I paid (something that I never would do).

The specifics of our casino require us to have a pretty quality low-latency connection, so AWS was a first choice. I was recommended to use ELB which could mitigate the level3 attacks (primariy SYN floods we were seeing) and automatically scale.

I setup a test instances, and tried orchestrate my own SYN flood which it handled without issue (while a normal ec2 instance would just collapse). So I put production behind ELBs, and a few hours later the attacks started.

The first thing was that under stress ELB stops being able to make connections, and starts failing your origins for status check (even when they were getting no load), but was able to successfully scale to mitigate the attack within 5-7 minutes. The attacker tried again a few hours later, but it seems things were nice and pre-warmed and the attack didn't get far.

For about a day there was a nice calm, and ELBs was performing absolutely fantastic (in terms of latency/jitter), and then I got the email that he's about to throw everything at me. And within a few minutes, he took out all the ELBs and it wasn't able to scale to handle the traffic for over an hour this time.

During this time I was in contact with CF's excellent support, and they offered me protection for websockets. It has slightly more latency than ELBs, but is actually an anti-ddos service, and works wonderfully. Since being fully behind CF we've only had one DDoS related outage, and it was specific to Seoul for about ~3 or 4 hours.

Can't recommend them enough, quite literally my business might not be around if it wasn't for them.

I don't think AWS mitigates DDOS. If an app is under DDOS at AWS and was using an Elastic Load Balancer, the app would have to pay for the inbound bandwidth through the ELB and would have to pay for scale-up to respond to the increased traffic load.

It'd be much more cost effective to pay CloudFlare a fixed monthly fee and stop the DDOS attack before it even gets to your AWS resources.

He last DDoS article from Amazon was a white paper which amounted to "we have enough capacity to let clients out-scale any attack." AKA it becomes a DDoS on your wallet instead of your server.

Edit: found it.

https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June20...

Agreed. We're full-stack AWS hosted, and I have no real indication of whether or not we've ever been attacked (doubtful) or if AWS could automatically mitigate an attack (possibly??). I presume Netflix is probably a common target, and they're AWS-heavy, but I have no way of knowing for sure.