ApsaraDB RDS protects your instances from network-level attacks through three built-in mechanisms: DDoS attack mitigation, traffic scrubbing, and SQL injection detection. Traffic scrubbing and blackhole filtering activate and deactivate automatically — no configuration required.
How it works
When an RDS instance is exposed to the Internet, the RDS security system monitors inbound traffic continuously. If a DDoS attack is detected, the system responds in two escalating stages:
Traffic scrubbing — The security system filters out malicious traffic while allowing normal traffic through. Your instance remains accessible.
Blackhole filtering — If scrubbing is insufficient or the blackhole triggering threshold is reached, the security system blocks all Internet traffic to the instance. Your instance becomes inaccessible from the Internet until the blackhole is lifted.
To avoid Internet-side DDoS exposure entirely, connect to your RDS instance over an internal network. Instances accessed exclusively over an internal network are not subject to Internet DDoS attacks.
Traffic scrubbing
Traffic scrubbing targets only Internet traffic and does not affect normal operations on your RDS instance.
Scrubbing is triggered when any of the following thresholds are exceeded:
| Metric | Threshold |
|---|---|
| Packets per second (PPS) | 30,000 |
| Bits per second (BPS) | 180 Mbit/s |
| New concurrent connections per second | 10,000 |
| Active concurrent connections | 10,000 |
| Inactive concurrent connections | 100,000 |
Blackhole filtering
Blackhole filtering targets only Internet traffic. When triggered, the instance cannot be accessed from the Internet and any applications that depend on Internet connectivity become unavailable. Blackhole filtering guarantees availability of RDS instances.
Blackhole filtering is triggered when either of the following conditions is met:
BPS reaches 2 Gbit/s.
Traffic scrubbing is ineffective.
Blackhole filtering is automatically deactivated in 2.5 hours.