Defending Against DDoS at the Edge

By Michael Samuel Naeem · June 8, 2025 · 5 min read

Your API stayed up during the traffic spike—because Cloudflare cached static assets while origin melted on uncached /api/search POSTs at 200k RPS from a botnet. Volumetric DDoS still exists, but application-layer floods targeting expensive endpoints are the daily headache. Defense belongs at the edge first: absorb, classify, challenge, drop—before packets consume your Kubernetes bill.

Architecture: edge before origin

Client → CDN/WAF → Rate limiter → Load balancer → App
                ↓
         DDoS scrubbing (always-on or on-demand)

Hide origin IP; allow inbound only from CDN provider ranges. Leaked origin IPs get bypass attacks—rotate and firewall.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Rate limiting strategies

Token bucket at edge; sliding window in Redis at app for authenticated fairness.

limit_req_zone $binary_remote_addr zone=api:10m rate=100r/s;
limit_req zone=api burst=200 nodelay;

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Challenge suspicious traffic

JS challenges and CAPTCHA impose cost on bots while browsers pass. Enable geo-fencing only as temporary measure—legitimate users use VPNs. Managed rulesets from Cloudflare, AWS Shield, or Fastly update faster than custom regex during zero-days.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Protect expensive endpoints

Search, report generation, and password reset are abuse magnets. Stricter limits, proof-of-work, or require authentication earlier in funnel. Move heavy work async with queue admission control.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Autoscaling is not defense

Scaling into attack raises cost; attackers win economically. Set max replicas and shed load with 503 + Retry-After rather than infinite scale. Budget alerts on egress and compute anomalies.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Observability

Dashboard: requests at edge vs origin, challenge solve rate, top paths, ASNs. Run game days simulating L7 flood against staging with approval.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

1. Confirm attack vs viral traffic (referrer, geographic skew)
2. Enable heightened WAF sensitivity
3. Tighten rate limits on targeted routes
4. Communicate status page if user-visible
5. Post-incident: add limit on exploited vector, file abuse report with upstream ISP/host

Hide origin IP; firewall allowlists CDN ranges only. Leaked origin IPs get bypass attacks—rotate and block direct access when discovered.

Game days simulate L7 flood against staging with approval. Runbooks link flag names to dashboards for payment_provider_enabled style kill switches.

Autoscaling into attack raises cost—set max replicas and shed load with 503 Retry-After rather than infinite scale. Budget alerts on egress anomalies catch economic denial of service.

Validate this in staging with production-like data volume before declaring done. Capture metrics baseline the week before change and compare for seven days after—subtle regressions hide in aggregates until a large tenant hits the path. Update the on-call runbook with the failure signature and rollback command so responders need not rediscover steps during an incident.

Document the decision, owner, and rollback path in your team wiki the same week you ship. Future you will not remember which environment variable toggled the behavior unless it is written next to the runbook entry and linked from the alert. That habit costs ten minutes per change and saves hours when pagination or auth misbehaves under a single large tenant.

Run the change through your standard PR checklist: tests, observability, and a two-minute rollback drill in staging. Small operational habits accumulate into systems that survive on-call nights without heroics.

Resources

• Cloudflare DDoS protection documentation
• AWS Shield documentation
• OWASP Denial of Service Cheat Sheet
• RFC 6585: 429 Too Many Requests
• NIST SP 800-189 DDoS guidance