> ## Documentation Index
> Fetch the complete documentation index at: https://resources.devweekends.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS Shield
> Managed DDoS protection service for AWS applications
## Overview
AWS Shield is a **managed DDoS (Distributed Denial of Service) protection** service that safeguards applications running on AWS. Think of Shield Standard as the fence around your property that comes free with the house -- it stops casual intruders (Layer 3/4 volumetric attacks) automatically. Shield Advanced is like hiring a 24/7 private security team (the DDoS Response Team) who will actively defend your property during a sophisticated attack, AND your insurance company (cost protection) reimburses you for any damage. Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
## Shield Standard vs Advanced
**Shield Standard (FREE)**
```yaml theme={null}
Automatic Protection:
- Enabled by default for all AWS customers
- No additional cost
- Always-on detection
- Automatic inline mitigation
Protection Coverage:
Layer 3/4 DDoS Attacks:
- SYN/ACK floods
- UDP reflection attacks
- DNS query floods
Protected Resources:
- Amazon CloudFront
- Amazon Route 53
- All AWS regions
Detection:
- Network flow monitoring
- Baseline traffic analysis
- Anomaly detection
- Automatic mitigation
Limitations:
- No DDoS cost protection
- No DDoS Response Team access
- Limited visibility
- No custom mitigations
Best For:
- All AWS workloads (default)
- Cost-sensitive applications
- Basic DDoS protection needs
- Standard web applications
```
**Shield Advanced (\$3,000/month)**
```yaml theme={null}
Enhanced Protection:
- Advanced DDoS detection
- Layer 7 attack mitigation
- Near real-time attack visibility
- Health-based detection
Protected Resources:
- CloudFront distributions
- Route 53 hosted zones
- Application Load Balancers (ALB)
- Network Load Balancers (NLB)
- Classic Load Balancers
- EC2 Elastic IP addresses
- AWS Global Accelerator
DDoS Response Team (DRT):
- 24/7 access to AWS experts
- Attack analysis and mitigation
- Post-event analysis
- Proactive engagement during attacks
- Custom mitigation strategies
Cost Protection:
- Protection against scaling costs
- Credits for DDoS-related charges
- Covers:
* CloudFront
* Route 53
* ELB
* EC2 data transfer
* Global Accelerator
Advanced Features:
- Custom AWS WAF rules at no cost
- Integration with WAF for L7 protection
- Attack diagnostics and forensics
- Historical attack data
- Proactive health checks
Visibility:
- Real-time attack metrics
- CloudWatch metrics
- Attack notifications
- Detailed attack reports
Best For:
- Mission-critical applications
- High-traffic websites
- Gaming platforms
- Financial services
- E-commerce sites
- Applications requiring SLA
```
## DDoS Attack Types
## Enabling Shield Advanced
### Via Console
### Subscribe to Shield Advanced
1. Navigate to AWS Shield console
2. Click "Subscribe to Shield Advanced"
3. Review pricing and terms
4. Confirm subscription
### Add Resources
1. Select resource types to protect
2. Choose specific resources
3. Configure protection groups (optional)
4. Enable automatic application layer mitigation
### Configure Notifications
1. Create SNS topic for alerts
2. Subscribe email/SMS endpoints
3. Configure alert preferences
### Set Up DDoS Response Team (DRT) Access
1. Create IAM role for DRT
2. Grant necessary permissions
3. Provide access to AWS WAF (optional)
### Terraform Configuration
```hcl theme={null}
# Enable Shield Advanced subscription
resource "aws_shield_subscription" "main" {
auto_renew = "ENABLED"
# This creates a 1-year commitment at $3,000/month ($36,000/year).
# Cost tip: The $3,000/month covers ALL protected resources in your
# organization -- it is a flat fee, not per-resource. So protecting
# 5 ALBs costs the same as protecting 50. The real variable cost is
# data transfer on protected resources (standard rates above 1 TB).
#
# Common mistake: Subscribing to Shield Advanced for a small website
# that gets 1,000 visits/day. At $36K/year, you need to be protecting
# revenue-critical workloads where a DDoS-related outage costs more
# than $36K. For most small-medium workloads, Shield Standard + WAF
# rate limiting is sufficient.
}
# Protect CloudFront distribution
resource "aws_shield_protection" "cloudfront" {
name = "cloudfront-protection"
resource_arn = aws_cloudfront_distribution.main.arn
tags = {
Environment = "production"
}
}
# Protect Application Load Balancer
resource "aws_shield_protection" "alb" {
name = "alb-protection"
resource_arn = aws_lb.main.arn
tags = {
Environment = "production"
}
}
# Protect Elastic IP
resource "aws_shield_protection" "eip" {
name = "ec2-eip-protection"
resource_arn = "arn:aws:ec2:us-east-1:123456789012:eip-allocation/eipalloc-12345678"
tags = {
Environment = "production"
}
}
# Protect Route 53 hosted zone
resource "aws_shield_protection" "route53" {
name = "route53-protection"
resource_arn = aws_route53_zone.main.arn
tags = {
Environment = "production"
}
}
# Protection Group (logical grouping).
# Groups let you treat related resources as a unit for detection.
# "MAX" aggregation means Shield triggers when ANY resource in the group
# is attacked. Use "SUM" when you want to detect distributed attacks that
# spread traffic across multiple resources to stay under individual thresholds.
resource "aws_shield_protection_group" "web_tier" {
protection_group_id = "web-tier-protection"
aggregation = "MAX"
pattern = "ARBITRARY"
members = [
aws_shield_protection.cloudfront.id,
aws_shield_protection.alb.id,
]
tags = {
Tier = "web"
}
}
# Health-based detection
resource "aws_shield_protection_health_check_association" "alb" {
health_check_arn = aws_route53_health_check.alb.arn
shield_protection_id = aws_shield_protection.alb.id
}
# Route 53 health check for ALB
resource "aws_route53_health_check" "alb" {
type = "HTTPS"
resource_path = "/health"
fqdn = aws_lb.main.dns_name
port = 443
request_interval = 30
failure_threshold = 3
tags = {
Name = "alb-health-check"
}
}
# DRT IAM role
resource "aws_iam_role" "drt" {
name = "AWSShieldDRTRole"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "drt.shield.amazonaws.com"
}
}
]
})
}
resource "aws_iam_role_policy_attachment" "drt_access" {
role = aws_iam_role.drt.name
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy"
}
# Grant DRT access to Shield
resource "aws_shield_drt_access_role_arn_association" "main" {
role_arn = aws_iam_role.drt.arn
}
# Grant DRT access to WAF (optional)
resource "aws_shield_drt_access_log_bucket_association" "main" {
log_bucket = aws_s3_bucket.waf_logs.id
role_arn_association_id = aws_shield_drt_access_role_arn_association.main.id
}
# SNS topic for Shield alerts
resource "aws_sns_topic" "shield_alerts" {
name = "shield-ddos-alerts"
}
resource "aws_sns_topic_subscription" "email" {
topic_arn = aws_sns_topic.shield_alerts.arn
protocol = "email"
endpoint = "security-team@example.com"
}
# CloudWatch alarm for DDoS detected
resource "aws_cloudwatch_metric_alarm" "ddos_detected" {
alarm_name = "shield-ddos-detected"
comparison_operator = "GreaterThanThreshold"
evaluation_periods = "1"
metric_name = "DDoSDetected"
namespace = "AWS/DDoSProtection"
period = "60"
statistic = "Sum"
threshold = "0"
alarm_description = "DDoS attack detected by Shield"
alarm_actions = [aws_sns_topic.shield_alerts.arn]
dimensions = {
ResourceArn = aws_lb.main.arn
}
}
```
## DDoS Response Team (DRT) Engagement
### Proactive Engagement
```hcl theme={null}
# Enable proactive engagement
resource "aws_shield_proactive_engagement" "main" {
enabled = true
emergency_contact {
contact_notes = "Primary security contact"
email_address = "security-primary@example.com"
phone_number = "+1234567890"
}
emergency_contact {
contact_notes = "Secondary security contact"
email_address = "security-secondary@example.com"
phone_number = "+0987654321"
}
}
```
### DRT Capabilities
```yaml theme={null}
DDoS Response Team Services:
Initial Response:
- Attack detection confirmation
- Impact assessment
- Immediate mitigation recommendations
During Attack:
- Real-time monitoring
- Custom mitigation deployment
- WAF rule creation and updates
- Traffic analysis
Post-Attack:
- Detailed attack analysis
- Forensic investigation
- Mitigation effectiveness review
- Recommendations for future protection
Proactive Engagement:
- Automatic escalation
- No need to contact AWS
- Immediate DRT involvement
- Based on Route 53 health checks
```
## Integration with AWS WAF
### Automatic DDoS Mitigation
```hcl theme={null}
# WAF Web ACL for Shield Advanced
resource "aws_wafv2_web_acl" "shield_integrated" {
name = "shield-advanced-integrated"
scope = "REGIONAL"
default_action {
allow {}
}
# Shield Advanced automatic mitigation rules
rule {
name = "shield-advanced-auto-mitigation"
priority = 0
override_action {
none {}
}
statement {
managed_rule_group_statement {
vendor_name = "AWS"
name = "AWSManagedRulesAmazonIpReputationList"
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "ShieldAutoMitigation"
sampled_requests_enabled = true
}
}
# Rate-based rule for DDoS protection.
# This is your first line of Layer 7 defense -- it blocks any single IP
# that exceeds 2,000 requests in a 5-minute window. During a DDoS attack,
# this catches the most aggressive bot IPs before they hit your origin.
#
# Cost tip: WAF rules are FREE with Shield Advanced (normally $1/rule/month
# + $0.60/M requests). This alone can save $50-100/month on WAF costs.
rule {
name = "rate-limit-shield"
priority = 1
action {
block {
custom_response {
response_code = 429
}
}
}
statement {
rate_based_statement {
limit = 2000
aggregate_key_type = "IP"
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "RateLimitShield"
sampled_requests_enabled = true
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "ShieldIntegratedWebACL"
sampled_requests_enabled = true
}
}
```
## Cost Protection
### How It Works
```yaml theme={null}
Shield Advanced Cost Protection:
Covered Services:
- Amazon CloudFront
- Amazon Route 53
- Elastic Load Balancing (ALB, NLB, CLB)
- Amazon EC2 (Elastic IPs)
- AWS Global Accelerator
Protected Costs:
Data Transfer Charges:
- Increased data transfer during DDoS
- Outbound data transfer fees
- Inter-region data transfer
Scaling Charges:
- Auto-scaling triggered by DDoS
- Additional compute costs
- Load balancer scaling
How to Claim:
1. DDoS attack must be confirmed
2. Attack causes resource scaling
3. Submit cost protection claim
4. AWS reviews and approves
5. Credits issued to account
Limitations:
- Must be Shield Advanced customer
- Attack must be confirmed by AWS
- Only covers scaling costs
- Does not cover base infrastructure
- Manual claim process required
```
## Monitoring and Metrics
### CloudWatch Metrics
```python theme={null}
import boto3
from datetime import datetime, timedelta
cloudwatch = boto3.client('cloudwatch')
def get_shield_metrics(resource_arn):
"""
Retrieve Shield Advanced metrics
"""
end_time = datetime.utcnow()
start_time = end_time - timedelta(hours=24)
# DDoS detected events
ddos_detected = cloudwatch.get_metric_statistics(
Namespace='AWS/DDoSProtection',
MetricName='DDoSDetected',
Dimensions=[
{
'Name': 'ResourceArn',
'Value': resource_arn
}
],
StartTime=start_time,
EndTime=end_time,
Period=300, # 5 minutes
Statistics=['Sum']
)
# Attack volume
attack_volume = cloudwatch.get_metric_statistics(
Namespace='AWS/DDoSProtection',
MetricName='AttackVolume',
Dimensions=[
{
'Name': 'ResourceArn',
'Value': resource_arn
}
],
StartTime=start_time,
EndTime=end_time,
Period=300,
Statistics=['Maximum', 'Average']
)
# Attack packets
attack_packets = cloudwatch.get_metric_statistics(
Namespace='AWS/DDoSProtection',
MetricName='AttackPackets',
Dimensions=[
{
'Name': 'ResourceArn',
'Value': resource_arn
}
],
StartTime=start_time,
EndTime=end_time,
Period=300,
Statistics=['Sum']
)
return {
'ddos_detected': ddos_detected,
'attack_volume': attack_volume,
'attack_packets': attack_packets
}
# Example usage
metrics = get_shield_metrics(
'arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890abcdef'
)
```
## Best Practices
Distribute content globally with CloudFront for best Shield protection
Configure Route 53 health checks for proactive DDoS detection
Combine Shield Advanced with WAF for comprehensive protection
Grant DRT necessary permissions before an attack occurs
### Security Checklist
```yaml theme={null}
Shield Implementation Checklist:
Standard (Free):
☐ Verify Shield Standard is active (automatic)
☐ Use CloudFront for web content
☐ Use Route 53 for DNS
☐ Monitor CloudWatch metrics
Advanced Setup:
☐ Subscribe to Shield Advanced
☐ Protect all public-facing resources
☐ Create protection groups
☐ Configure health checks
☐ Set up DRT IAM role
☐ Grant DRT access to WAF
☐ Configure emergency contacts
☐ Enable proactive engagement
☐ Set up CloudWatch alarms
☐ Test notification channels
Integration:
☐ Configure AWS WAF rules
☐ Enable automatic mitigation
☐ Set rate limiting rules
☐ Configure geo-blocking if needed
Operations:
☐ Regular review of metrics
☐ Test DRT contact procedures
☐ Document incident response plan
☐ Review cost protection eligibility
☐ Maintain architecture diagrams
```
## Cost Analysis
```yaml theme={null}
Shield Pricing:
Shield Standard:
Cost: FREE
Included: Always-on detection and mitigation
Coverage: CloudFront and Route 53
Shield Advanced:
Subscription: $3,000 per month
Commitment: 1-year minimum
Data Transfer (Outbound):
First 1 TB: FREE (included in subscription)
Over 1 TB: Standard data transfer rates
Protected Resources:
CloudFront: Included
Route 53: Included
ALB/NLB/CLB: Included
EC2 Elastic IP: Included
Global Accelerator: Included
WAF Charges:
Web ACL: FREE (normally $5/month)
Rules: FREE (normally $1/rule/month)
Requests: Standard WAF rates apply
DRT Access: Included
Cost Protection: Included
Cost Optimization:
- Start with Shield Standard
- Upgrade to Advanced for critical workloads
- Use protection groups for efficient management
- Monitor attack trends before committing
- Calculate potential scaling costs
- Compare with manual mitigation costs
```
## Exam Tips
* **Shield Standard** is FREE and automatic for all AWS customers
* **Shield Advanced** costs \$3,000/month with 1-year commitment
* Shield Standard protects **Layer 3/4** (network/transport)
* Shield Advanced adds **Layer 7** protection with WAF integration
* **DRT (DDoS Response Team)** available only with Shield Advanced
* **Cost protection** credits for DDoS-related scaling costs
* Shield Advanced required for **proactive engagement**
* **Health-based detection** uses Route 53 health checks
**Q: How to protect against SYN flood attacks?**
A: Shield Standard (FREE) provides automatic protection
**Q: Need 24/7 DDoS support during attacks?**
A: Use Shield Advanced to access DDoS Response Team (DRT)
**Q: How to protect against Layer 7 DDoS?**
A: Shield Advanced + AWS WAF integration
**Q: Want credits for DDoS-related scaling costs?**
A: Shield Advanced provides cost protection
**Q: How to get automatic DDoS notifications?**
A: Shield Advanced with CloudWatch alarms and SNS