Amazon says AWS Shield mitigated a 2.3 Tbps DDoS attack in mid-February, the largest ever; the previous record was a 1.7 Tbps DDoS attack from March 2018
Context & Ripple Effects
Amazon has been selling DDoS protection since it debuted AWS Shield in December 2016 as a direct Cloudflare competitor with a free default tier. The mid-February 2020 event is its proof point: a 2.3 Tbps volumetric flood, roughly 35% larger than the 1.7 Tbps March 2018 record, absorbed by Shield on behalf of a customer.
The record-claiming itself has become part of the product story — within 18 months Microsoft countered with a 2.4 Tbps mitigation on Azure, and by August 2023 the same trio was reporting a 398M RPS HTTP-layer attack, showing how the measurement battleground has shifted from raw bandwidth to request rates.
First-order effects
- The targeted AWS customer stays online through what would have been an outage-scale flood, and AWS gains a headline defense capability claim to sell Shield Advanced against Cloudflare and Azure DDoS protection.
- Cloud operators' sales teams now have a quantified benchmark to cite: 2.3 Tbps absorbed sets the bar any rival must publicly beat to claim parity.
Second-order effects
- Microsoft answered within about a year and a half with its own record-breaking 2.4 Tbps Azure mitigation, turning each vendor announcement into a forced response cycle rather than isolated news.
- Cloudflare, which had been publicizing per-request-rate mitigations like the 17.2M rps attack on a financial-industry customer, faces pressure to match both the bandwidth numbers and the disclosure cadence of the hyperscalers.
Third-order effects
- If the pattern holds, DDoS mitigation capacity becomes a marketed differentiator in cloud contracts, with vendors competing via disclosed record mitigations and the industry migrating its yardstick from Tbps toward requests-per-second as attacks move up the stack.
- Escalating attack sizes push mitigation further into shared global infrastructure owned by a few large platforms, raising the bar for smaller CDN and hosting providers that cannot absorb multi-terabit floods on their own networks.
The trend: DDoS protection is consolidating into a hyperscale arms race where record mitigations serve as competitive marketing and attack volume keeps resetting the benchmark.