Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Reading how an online news portal Sarawak Report was under massive, well-funded, sophisticated DDOS attack and unable to function as normal, I wonder what should normal webmasters do in the light of such an event.

Do you think that if I host my web app at Amazon EC2/S3, then I am safe from DDOS? I thought that Amazon ( or Google App Engine) should have a better security measure, and better idea on how to stop this kind of abuse.

What do you think?

share|improve this question
up vote 5 down vote accepted

No, hosting on Amazon EC2 is not adequate protection from DDoS.

According to one of the AWS engineers, "Once you have exposed your instance on a particular port (or set of ports and protocols) using EC2 authorize, there is no explicit DDOS protection offered by EC2."

There is a well documented case where bitbucket.org was knocked off the web for most of a day because of a DDoS when they were hosted on EC2. This is not pointing the finger at Amazon, but just to highlight that their cloud doesn't automatically make things perfect. You can read Bitbucket's account of the attack here:

Having said that, there are lots of resources available on the Amazon forums on how to protect yourself from and mitigate the effects of DDoS attacks. Some of the techniques apply to any web architecture, some are specific to AWS. Plenty of reading for you here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.