Tackling Toil: SecOps Automation at Amplify Education
summary
Amplify uses Datadog workflows plus AWS WAF and Datadog Security Monitoring to turn noisy network alerts into automated actions. A custom IP Blocker service writes IP records to DynamoDB, streams to Lambdas and SQS, then updates IP sets across accounts and regions; it stores TTLs, reasons and an audit log and exposes a UI for ad hoc fixes. Soft and hard WAF rate limits plus detection rules reduce alerts by about 97% and block tens of millions of requests (50M vs 35M year over year).
AI-written summary · about
chapters (13)
- 0:00Introduction to SecOps automation
- 1:04Rate limiting challenges at Amplify
- 3:35DataDog Seam for traffic analysis
- 7:06Customer IP management in WAF
- 9:54Defining malicious traffic patterns
- 12:22Proactive IP reputation defenses
- 15:14Automating IP blocking across AWS
- 18:03IP Blocker service architecture
- 21:18DataDog workflow automation
- 24:28Rate limit alert automation
- 27:42IP Blocker UI for manual changes
- 32:21Results and next steps
- 34:54Q&A session
related talks
24mOne EdTech’s journey to transforming its security practices
01h 02mSecuring data and democratizing the alert landscape
33mAutomation Best Practices for SRE and Security
23mAn EdTech’s journey to transforming its security practices
28mPatterns for scalable security detections on AWS
21mRecognizing and avoiding cloud security survival mode
18mHow AWS Partners use observability to strengthen customer security
28mPatterns for scalable security detections on AWS