A CDN is not a firewall

A CDN is not a firewall
A Melbourne ticketing site assumed turning on a CDN meant they were now DDoS-proof. A 12 Gbps layer-7 flood hit during an on-sale and the origin fell over anyway.
The myth: edge caching absorbs attacks automatically. The truth: their attack targeted /api/checkout, an uncacheable POST route that passed straight through to origin.
What we changed: we put rate limiting and a managed challenge in front of the dynamic API, kept the CDN cache for static pages, and added an origin shield so legit misses funneled through one region.
Result: the next flood, 18 Gbps, never reached origin; checkout stayed up; bandwidth to origin dropped 96%.
The edge cache protects what it caches. Dynamic routes need actual rules.
The number that mattered: 96% less origin traffic during the second attack.