Share via

Securing Azure Paas Services from DDoS attacks

Satyam Chauhan 542 Reputation points
2023-03-15T14:52:13.95+00:00

Hi,

We are using azure PaaS services like Cosmos Db, App services etc, which is having public access and is also not in Vnet. in this this case does azure PaaS service have any default DDoS protection/mitigation. If not kindly suggest how DDoS protection can be enabled.

Thanks,

Satyam

Azure DDos Protection
Azure DDos Protection
An Azure service that provides defense against distributed denial-of-service (DDoS) attacks.
68 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 24,656 Reputation points Microsoft Employee
    2023-03-15T23:50:36.7+00:00

    @Satyam Chauhan

    Thank you for reaching out.

    If I understand correctly, you are using PaaS services which are publicly accessible and not integrated with a virtual network and you want to know how you can set-up DDOS protection for these services.

    Based on your question above.

    in this this case does azure PaaS service have any default DDoS protection/mitigation. If not kindly suggest how DDoS protection can be enabled.

    Services running on Azure are inherently protected by the default infrastructure-level DDoS protection. However, the protection that safeguards the infrastructure has a much higher threshold than most applications have the capacity to handle, and does not provide telemetry or alerting, so while a traffic volume may be perceived as harmless by the platform, it can be devastating to the application that receives it. This is currently documented here.

    The recommended approach in such scenarios is to deploy the Paas Services behind Azure Application Gateway with Web Application Firewall(WAF) and enable DDOS Network protection for the Application Gateway's Virtual Network. You also need to configure your PaaS services to receive traffic only from Azure Application Gateway. The architecture is explained in detail here. DDOS Network protection provides protection against Layer 3 and Layer 4 DDOS attacks and Web Application Firewall protects against Layer 7 DDOS attack. You can go through this article for more information on Types of attacks Azure DDoS Protection mitigates.

    Hope this helps! Please let me know if you have any additional questions.

    ​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.