Protect an ECS instance from HTTP flood attacks

An HTTP flood attack is a type of DDoS attack that overwhelms a server with a high volume of concurrent requests. This can exhaust computing resources or database connections, leading to slow response times and service unavailability, often indicated by a surge in QPS and increased bandwidth usage. To protect your public-facing ECS instances from these attacks, enable Web Application Firewall (WAF). WAF provides effective defense against HTTP flood attacks, ensuring your services remain stable.

Prerequisites

• The ECS instance hosts a web service accessible via a public IP address.

• The ECS instance must be in one of the following regions: China (Chengdu), China (Beijing), China (Zhangjiakou), China (Hangzhou), China (Shanghai), China (Shenzhen), China (Qingdao), China (Hong Kong), Malaysia (Kuala Lumpur), Indonesia (Jakarta), or Singapore. If this requirement is not met, use CNAME access.

Step 1: Activate a pay-as-you-go WAF

1. Go to the Web Application Firewall 3.0 (Pay-As-You-Go) purchase page.

2. Set Asset Type to Web Application Firewall 3.0 and Billing Method to Pay-as-you-go, and then configure the following parameters.

   Parameter	Description
   Region	Determines the location of the WAF protection nodes. If your ECS instance is deployed in the Chinese mainland, select Chinese Mainland. Otherwise, select Outside Chinese Mainland.
   Version	Defaults to Pay-as-you-go. No configuration is required.
   Service-Linked Role	WAF requires access to your cloud resources to provide services such as traffic access control and monitoring. Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForWaf role. Do not manually modify this role.

3. Click Buy Now and complete the purchase.

Step 2: Onboard an ECS instance

1. Log in to the Web Application Firewall 3.0 console. In the top menu bar, select a resource group and a region (Chinese Mainland or Outside Chinese Mainland). In the left-side navigation pane, click Onboarding. Select the Cloud Native tab, and then select Elastic Compute Service (ECS).

2. Find the target ECS instance in the list. In the Actions column, click Add Now. If you cannot find the instance, click Synchronize Assets in the upper-right corner. If you still cannot find the instance, it does not meet the requirements in Prerequisites.

3. In the Select instances & ports to protect area, click Add Port in the Actions column.

4. In the Add Port dialog box that appears, configure the port and protocol type for your website.

   • Standard HTTP website

     If your website address is http://yourdomain.com, set Protocol Type to HTTP and Port to 80.

   • Standard HTTPS website

     If your website address is https://yourdomain.com, set Protocol Type to HTTPS and Port to 443.

   • Non-standard port website

     If the website address that you want to add explicitly includes a port number in the format Domain name:Port number, you must enter the actual port number. For example:

     • For http://yourdomain.com:8080, set Protocol Type to HTTP and Port to 8080.

     • For https://yourdomain.com:8443, set Protocol Type to HTTPS and Port to 8443.

   HTTP

   1. In the Port section, enter the port used by your website.

   2. In the Protocol Type section, select HTTP.

   HTTPS

   1. In the Port area, enter the port used by your website.

   2. In the Protocol Type area, select HTTPS.

   3. Keep the default settings for HTTP2, TLS Version, Cipher Suite, and Additional Certificate.

   4. In the Default Certificate area, select a method to upload a certificate:

      • Choose this method if you have not uploaded your certificate to Alibaba Cloud Certificate Management Service (Original SSL Certificate).

      • Select an existing certificate from Alibaba Cloud Certificate Management Service (Original SSL Certificate).

        Manual upload

        • Certificate Name: Enter a unique certificate name.

        • Certificate File: Open the certificate file and paste its content. The certificate must be in the PEM, CER, or CRT format.

          Example format: -----BEGIN CERTIFICATE-----......-----END CERTIFICATE-----

          • Format conversion: If your certificate is in a format such as PFX or P7B, use the certificate tool to convert it to the PEM format.

          • Certificate chain: If an intermediate certificate is included, paste the server certificate followed by the intermediate certificate.

        • Private Key: Open the private key file and paste its content. The private key must be in the PEM format.

          Example format: -----BEGIN RSA PRIVATE KEY-----......-----END RSA PRIVATE KEY-----

        Select existing certificate

        Select the certificate that you want to upload to WAF from the drop-down list.

        Note

        If the WAF console shows "Failed to verify the integrity of the certificate chain. If you use this certificate, service access may be affected.", the certificate chain is incomplete. Verify that the certificate content is correct and complete, and then re-upload it in the Certificate Management Service console. For more information, see Upload, synchronize, and share SSL certificates.

5. Keep the default settings for other parameters and click OK.

6. (Optional) View the protected object: After the ECS instance is added, WAF automatically creates a protected object named in the format instance-id-port-asset-type. By default, WAF enables protection rules for this object, such as core web protection rules. You can view the protected object on the Protection Config > Protected Objects page.

7. Verify basic protection: Access the website hosted on the ECS instance in a browser and append a web attack test string to the URL, such as http://yourdomain.com/alert(xss). If WAF returns a 405 block page, it indicates that protection is working.

Step 3: Configure HTTP flood protection rules

1. In the left-side navigation pane, choose Protection Config > Core Web Protection.

2. At the bottom of the page, in the HTTP Flood Protection section, click Create Template.

3. In the Create Template panel, configure the following parameters.

   Parameter	Description
   Template Name	Enter an easy-to-identify name for the template.
   Save as Default Template	Keep this turned off.
   Protection Mode	Standard Mode: Intercepts only requests with obvious attack characteristics. This mode has a low false positive rate and is suitable for daily operations and stable traffic. Strict Mode: Uses a high-intensity detection algorithm that can effectively block HTTP flood attacks but has a higher risk of false positives. We recommend enabling this mode only if Normal Mode fails and you experience response delays or abnormal resource loads (CPU/memory). Note Strict Mode applies only to web (including H5) services. Do not use it for API endpoints or native apps to prevent a high rate of false positives.
   Action	Defines what happens when a request matches the protection rule. Select JavaScript Validation.
   Apply To	In the Available Objects area, select the protected object for your ECS instance. Click the icon to move it to the Selected area.

   

4. Click OK.

Step 4: View attack protection data

After the configuration is complete, go to the Overview page from the left-side navigation pane. You can view information such as Protection Overview and Top 10 Attacks to analyze your services' security.

Choose the next step based on your requirements:

• Continue to use WAF (recommended): Proceed to Advanced optimization.

• Stop using WAF: Proceed to Release resources to stop billing.

Advanced optimization: enhance protection and control costs

You can further adjust the settings from this topic to meet your specific business requirements, enhancing security while lowering costs.

• Multi-module collaborative protection: You can combine it with the following modules for a more robust defense.

  • Custom rules: Create precise rules for specific attack patterns by using flexible match conditions and actions. For example, you can configure frequency control rules to implement rate limiting.

  • Whitelist: Allow requests that meet specified criteria, such as those from trusted IP addresses.

  • IP blacklist: Block access from known malicious IP addresses.

  • Region block: Block requests from specific geographic regions. For example, if your business serves only users within China and detects a large number of attacks from outside China, you can enable this feature.

• Advanced onboarding options: WAF provides multiple onboarding methods. You can choose one based on your business requirements.

  • Onboard ECS instances in Cloud Native mode: This topic uses this method for quick onboarding. If you need to configure TLS versions, cipher suites, or multiple certificates, see Enhance HTTPS security. If you need to configure Layer 7 proxy settings (such as a CDN) in front of WAF or configure traffic tagging, see Obtain real client information.

  • CNAME access: Add resources by using domain names. This method offers greater flexibility, fewer restrictions, and broader feature support.

• Cost optimization suggestions:

  • SeCU Resource Plan: This is a cost-optimization plan for pay-as-you-go WAF. After you activate a pay-as-you-go WAF instance, you can purchase a SeCU resource plan to offset the total pay-as-you-go charges.

  • Subscription WAF: If you plan to use WAF for a long period, we recommend that you purchase a subscription WAF instance to get a better unit price.

Release resources to stop billing

After you complete this quick start, if you no longer need the WAF instance from this tutorial, follow these steps to disable it and stop billing.

1. Go to the Overview page from the left-side navigation pane. In the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of the WAF instance.

2. If the following page is displayed, click Go to Console in the upper-right corner. If this page is not displayed, skip this step.

3. On the right side of the page, click Terminate WAF Service. In the dialog box, select the relevant checkboxes and click OK.