How to customize your response to layer 7 DDoS attacks using AWS WAF Anti-DDoS AMR

This article explains how to customize AWS WAF Anti-DDoS AWS Managed Rules (AMR) to tailor Layer 7 DDoS attack responses to your application's specific needs.

• Anti-DDoS AMR detects anomalies and labels requests with event-detected and ddos-request metadata
• Default mitigations combine Block and JavaScript Challenge actions based on suspicion levels
• Customize by adding rules using labels from Anti-DDoS AMR for enhanced protection
• Example 1: Block more aggressively outside core countries using geo-matching and labels
• Example 2: Lower rate-limiting thresholds during detected DDoS events
• Example 3: Adaptive response based on application capacity using count mode and custom labels
• Use JSON rule editor or IaC tools like CloudFormation to implement complex customizations

Combining Anti-DDoS AMR protections with custom rules enables fine-tuned defenses matching your risk profile and application scalability.