How does Amazon Auto scaling work in a DDos attack

Question

I have setup my auto scaling group to add a new EC2 instance when Elastic Beanstalk CPU usage above 60% for 5 mins.

I get that but what happen if adding 1 instance is not enough and CPU usage is still above 60%, does auto scaling group add more EC2 instances until CPU usage goes below 60%?

Answer 1

The auto-scaling mechanism consists of 2 parts one is the auto-scaling-group that holds the AMI to launch and the min/max/current amount of servers to run. An auto-scaling-group has scaling polices which can be triggered, the actions can for example - add a server / remove a server / add 20% of current servers.

the second part is CloudWatch which monitors the servers in your auto-scaling-group and can trigger a scaling policy, for example if all servers are above 60% CPU for z amount of time trigger policy X. or if network in to servers for x amount of time is above X trigger policy Y.

once a policy is triggered there is a grace period before checking the metrics again.

In your case i would suggest creating 2 CloudWatch metrics according to CPU and Network IN.

And yes

auto scaling group add more EC2 instances until CPU usage goes below 60%