Distributed denial of service (DDoS) is considered as one of the most serious threats to emerging cloud computing infrastructures. It aims at denying access to the cloud infrastructure by making it unavailable to its users. This can cause important economic and organizational damage depending on the type of applications running on the cloud that have become unavailable. This paper proposes an extension to a federated cloud architecture to use scalability and migration of virtual machines to build scalable cloud defenses against cloud DDoS attacks. The architecture is validated by showing how three DDoS attack scenarios are handled by the DDoS countermeasures.