CONFIGURING THE AWS WAF ANTI-DDOS MANAGED RULE GROUP FOR YOUR RESOURCES AND CLIENTS

Summary from the TLDR InfoSec newsletter

AWS WAF provides an Anti-DDOS managed rule group to detect and mitigate HTTP DDOS events. By default, the rule group uses a JavaScript challenge for all GET requests with low or medium suspicion and blocks all GET requests with high suspicion of contributing to DDoS attacks. This post provides ways to customize the rule group for scenarios where clients don't support the JavaScript challenge, clients can't use the WAF client integration, non-challengeable requests overwhelm resources, and when challengeable requests overwhelm resources before they're blocked.