TicketSauce hits 99.99% uptime, cuts IT cost 30% migrating Rackspace to AWS

Event ticketing is a high-value, DDoS-attractive workload: bots contend for inventory, card-testing traffic probes the payment flow, and volumetric attacks aim at the exact minutes when legitimate demand peaks. The migration to AWS made the platform elastic — but elasticity without edge filtering just means scaling to absorb malicious traffic at cost. TicketSauce already operated a CDN edge with its own filtering; the challenge was layering AWS-native protection at the origin so the platform is defended even for traffic paths that bypass the CDN, without the two rule sets fighting each other.

The migration carried an explicit WAF module, and VeUP treated it as engineering, not a checkbox. An AWS WAF web ACL sits on the public Application Load Balancer — the origin front door behind AWS Global Accelerator — filtering requests before they reach the auto-scaling Amazon ECS application tier. The rules were deliberately tuned against the CDN/WAF edge topology: where the CDN already handles a class of traffic, the origin ACL is shaped to complement rather than duplicate it, and where traffic can reach the origin directly, the ACL stands as the enforcement point — true defense-in-depth instead of two blind overlapping filters. AWS Shield guards the public endpoints against volumetric attack, and the edge configuration is monitored through Amazon CloudWatch alongside the platform’s availability metrics, so protection and performance are read from the same pane during peak on-sales.