AWS Network Firewall to protect against DDoS layer 7 attacks

Hello, We have a public API (many of them) and I am looking into how we can protect against large scale layer 7 DDoS type attacks, for example a HTTP GET. The proposed architecture that we have come up with involves asynchronously detecting bad IP addresses based on signals (web server logs), and blocking by IP at network level (osi 3). We want to block at network level as it’s likely to be much more performant and cost effective than attempting to do it at application/compute level.

We already have AWS Shield Advanced.

We have identified the AWS Network Firewall as a possible place to enforce the blocking of these bad IPs. However, I have a question about the scale in which the AWS Network Firewall can block bad IP addresses. In the FAQ (https://aws.amazon.com/network-firewall/faqs/) it says:

Q: Can I use AWS Network Firewall for protection against DDoS attacks?

AWS Network Firewall is designed to protect and control access to and from your VPC, but not to mitigate volumetric attacks, like distributed denial of service (DDoS), that can impact the availability of your application. To protect against DDoS attacks and ensure application availability, we recommend customers review and adhere to our AWS Best Practices for DDoS Resiliency, and also explore AWS Shield Advanced, which offers managed DDoS protection customized to your specific application traffic.

My question is this: is this recommendation based on the AWS Network Firewalls inability to apply rules (I.e. block by IP address’) at a large scale, or is this specifically the volumetric attacks.

To clear some things up:

• We have AWS shield advanced - so I expect that we have most volumetric type attacks covered
• The DDoS attacks we are trying to protect against are mostly layer 7 targeted (e.g. HTTP GET index.html)
• Ability to detect bad IP addresses based on signals is out of scope, assume we have a 3rd party OTT product that can detect bad IP’s from our web server logs and apply custom rules managed by us
• We cannot use cloudflare/fastly etc
• Scale of layer 7 DDoS that we are likely to want to protect against: ~10k source ip addresses each doing around 1k HTTP requests per second, (total ~10M http requests p/s) - typically any ip doing over 1k requests per second would be a strong signal and we would likely want to block that IP for some time. Sorry, I don’t know how to translate the volume of http layer 7 requests into volume of layer 3 packets I can only comprehend it in http requests per second.