Object Storage Service:OSS DDoS protection

Scenarios

DDoS attacks are one of the most damaging threats to businesses. An attack can interrupt your services, which can harm your company's image, lead to customer churn, and cause revenue loss. These attacks severely affect normal business operations.

OSS integrates with Anti-DDoS Pro and Anti-DDoS Premium to provide robust protection. This integration offers terabit-level DDoS mitigation, protection for millions of queries per second (QPS), and attack failover within seconds. It effectively counters terabit-level DDoS flood attacks, large-scale CC attacks, and other attacks such as SYN Flood, ACK Flood, ICMP Flood, UDP Flood, NTP Flood, SSDP Flood, DNS Flood, and HTTP Flood. This ensures that your services remain available during an attack.

Precautions

• OSS DDoS protection does not handle low-volume fraudulent traffic that mimics normal requests. To prevent this type of traffic, you can configure access control using policies or access control lists (ACLs), or configure Web Application Firewall (WAF) protection. For more information, see How do I prevent my OSS bucket from being flooded by malicious traffic?.

• OSS DDoS protection cannot effectively mitigate medium-scale CC attacks.

How it works

The following figure shows how OSS DDoS protection works.

By default, OSS uses Anti-DDoS Origin to protect your buckets. If an attack exceeds the protection threshold of Anti-DDoS Origin, protection becomes ineffective, which may cause access to your bucket to fail.

After you enable OSS DDoS protection, if an attack exceeds the threshold of Anti-DDoS Origin, OSS automatically redirects all traffic for the attacked bucket to the Anti-DDoS clusters. Malicious attack traffic is scrubbed in the scrubbing centers. Non-malicious traffic is forwarded to the target bucket using port and protocol forwarding. This ensures stable access to the bucket during an attack.

After the attack ends, the bucket's traffic is switched back to Anti-DDoS Origin for protection.

Limits

• You can configure OSS DDoS protection in the following regions: China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Shenzhen), and China (Hong Kong).

• OSS DDoS protection protects only public bucket endpoints (for example, oss-cn-hangzhou.aliyuncs.com). It does not support the following types of domain names:

  • Acceleration endpoints (oss-accelerate.aliyuncs.com and oss-accelerate-overseas.aliyuncs.com)

  • Access point domain names (for example, ap-01-3b00521f653d2b3223680ec39dbbe2****-ossalias.oss-cn-hangzhou.aliyuncs.com)

  • Object FC access point domain names (for example, fc-ap-01-3b00521f653d2b3223680ec39dbbe2****-opapalias.oss-cn-hangzhou.aliyuncs.com)

  • Endpoints accessed over IPv6 (for example, cn-hangzhou.oss.aliyuncs.com)

  • Amazon S3 endpoints (for example, s3.oss-cn-hongkong.aliyuncs.com)

• An Anti-DDoS for OSS instance must be retained for at least 7 days after it is created. If you delete the instance within 7 days, you are charged a basic resource fee for the remainder of the 7-day period. For more information about billing, see DDoS protection fees.

• You can create one Anti-DDoS for OSS instance per region. Each instance can be attached to a maximum of 10 buckets in the same region.

• After you attach a bucket to an Anti-DDoS instance, you cannot preview resources in the bucket from a browser. By default, OSS DDoS protection does not protect custom domain names that are associated with the bucket. Therefore, you cannot access OSS through a custom domain name when the bucket is under attack. If you want to access the bucket through a custom domain name during an attack, you must add the custom domain name to the protection list in the OSS DDoS protection console. You can protect up to five custom domain names for each bucket.

  If a custom domain name that you want to protect for a bucket (such as www.example.com) matches a domain name (www.example.com) or a wildcard domain name (*.example.com) for which a forwarding rule is configured in Anti-DDoS Pro, you must go to the Anti-DDoS Pro console to detach the domain name or wildcard domain name. Otherwise, you cannot access OSS through the custom domain name when the bucket is under attack.

  For more information about forwarding rules for domain names and wildcard domain names, see Add a website configuration.

Use the OSS console

1. Create an Anti-DDoS for OSS instance.

   1. Log on to the OSS console.

   2. In the navigation pane on the left, choose Data Service > Anti-DDoS Pro.

   3. Optional: The first time you use OSS DDoS protection, click Activate Now on the Anti-DDoS Pro page.

   4. On the Anti-DDoS Pro page, you can click Create Anti-DDoS for OSS Instance and select a Region.

   5. Click OK.

2. Attach a bucket.

   1. In the Actions column of the target instance, click View and Attach Buckets.

   2. In the View and Attach Buckets panel, click Attach Anti-DDoS Buckets.

   3. In the Attach Anti-DDoS Buckets dialog box, select a bucket from the Bucket drop-down list.

      Buckets that are already attached to an Anti-DDoS for OSS instance do not appear in the Anti-DDoS Bucket drop-down list.

   4. Click OK.

      After you attach the bucket, its status is Initializing. When the status changes to Protecting, the Anti-DDoS for OSS instance starts protecting the bucket's domain name.

3. To protect a custom domain name, add the custom domain name.

   Important

   By default, OSS DDoS protection does not protect custom domain names that are associated with a bucket. Therefore, you cannot access OSS through a custom domain name when the bucket is under attack. If you want to access the bucket through a custom domain name during an attack, you must add the custom domain name for protection. You can add up to five custom domain names for each bucket. The domain names can belong to a maximum of four different top-level domains (sites). For example, a.mycname.com and b.mycname.com belong to the same site, while c.othercname.com belongs to a different site.

   • If the bucket is not yet attached to a custom domain name, you must first attach one. For more information, see Attach a custom domain name.

   • If the bucket is already attached to a custom domain name, follow these steps to add the custom domain name for protection:

     1. In the Actions column for the attached Anti-DDoS bucket, click Modify Custom Domain Name.

     2. Select the custom domain name that you want to protect.

     3. Click OK.

        The Anti-DDoS for OSS instance starts to protect the selected custom domain name.