ApsaraDB RDS provides a variety of attack mitigation methods, including DDoS attack mitigation, traffic scrubbing, and SQL injection detection. When attacks are detected, the RDS security system responds without requiring manual intervention.
How it works
When an RDS instance is reachable from the Internet, it is exposed to DDoS attacks. ApsaraDB RDS defends against these attacks in two sequential layers:
Traffic scrubbing — the first line of defense. When attack traffic reaches the triggering thresholds, the security system scrubs inbound traffic to filter out malicious packets while keeping the instance operational.
Blackhole filtering — activated when traffic scrubbing cannot contain the attack, or when the blackhole triggering threshold is reached. Blackhole filtering blocks all Internet traffic to the instance and is automatically lifted after 2.5 hours.
To reduce exposure to DDoS attacks, access RDS instances over an internal network instead of the Internet.
Traffic scrubbing
Traffic scrubbing targets only Internet traffic and does not affect normal database operations.
Traffic scrubbing is triggered when any of the following thresholds are reached:
| Metric | Threshold |
|---|---|
| Packets per second (PPS) | 30,000 |
| Bits per second (BPS) | 180 Mbit/s |
| New concurrent connections per second | 10,000 |
| Active concurrent connections | 10,000 |
| Inactive concurrent connections | 100,000 |
Blackhole filtering
Blackhole filtering targets only Internet traffic. When triggered, the RDS instance cannot be accessed from the Internet and connected applications become unavailable. Blackhole filtering guarantees availability of RDS instances.
Blackhole filtering is triggered when either of the following conditions is met:
BPS reaches 2 Gbit/s.
Traffic scrubbing is ineffective.
Blackhole filtering is automatically deactivated after 2.5 hours.
Recommendations
To minimize the risk of DDoS attacks and reduce the impact of blackhole filtering on your applications:
Use an internal network connection. Connecting to RDS instances over a Virtual Private Cloud (VPC) or internal network eliminates exposure to Internet-facing DDoS attacks entirely.
Plan for blackhole filtering downtime. When blackhole filtering is triggered, Internet-facing connections are unavailable for 2.5 hours. Design your application to handle this gracefully, for example by implementing retry logic or routing traffic through an internal endpoint as a fallback.