Skip to main content

AWS Shield

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. It provides automatic network and application layer defense to ensure the availability and reliability of your resources. Here’s what you need to know about AWS Shield:

1. Two Levels of Protection: Standard and Advanced​

  • AWS Shield Standard: Included at no extra cost with AWS services like Amazon CloudFront, Elastic Load Balancing (ELB), Amazon Route 53, and more. It automatically protects against common and most frequent DDoS attacks, such as SYN/ACK floods, reflection attacks, and UDP reflection attacks.
  • AWS Shield Advanced: A paid service offering more sophisticated, detailed, and proactive DDoS protection. It is designed for higher-level protection, covering complex and large-scale attacks. Features include enhanced protection for web applications, advanced threat intelligence, and near real-time attack visibility.

2. Automatic Protection for AWS Services​

  • AWS Shield Standard is automatically enabled for resources like Amazon EC2, CloudFront, Route 53, and Elastic Load Balancing without requiring user intervention. It provides baseline DDoS protection at the infrastructure level.

3. Protection Against Different Types of Attacks​

  • AWS Shield protects against the most common types of DDoS attacks:
    • Volumetric Attacks: Flood the network with excessive traffic, causing service disruptions.
    • State-Exhaustion Attacks: Target resources like load balancers and firewalls by overwhelming connection tables.
    • Application Layer Attacks (Layer 7): These are sophisticated attacks targeting the application layer, such as HTTP floods. Shield Advanced provides enhanced protection against these.

4. Shield Advanced Features​

  • Enhanced DDoS Protection: Includes additional protections beyond Shield Standard, including detailed attack diagnostics and automated application traffic monitoring.
  • Global Threat Environment Dashboard: Provides visibility into global DDoS trends and threats that could affect your AWS resources.
  • Attack Diagnostics and Reporting: In-depth attack diagnostics for real-time visibility into the nature and scale of attacks. It offers metrics and CloudWatch alarms for proactive monitoring.
  • Cost Protection: In the event of a DDoS attack, Shield Advanced provides financial protection for increased costs due to scaling of resources or data transfer charges caused by the attack.
  • DDoS Cost Protection: Shields against scaling costs resulting from an attack, ensuring that customers don’t incur unexpected charges due to a defensive scaling response.

5. DDoS Response Team (DRT) Support​

  • With AWS Shield Advanced, you have access to the AWS DDoS Response Team (DRT), a group of experts who can assist in mitigating ongoing attacks, analyzing traffic patterns, and applying custom mitigations to safeguard your applications.

6. Integration with AWS WAF​

  • Shield Advanced integrates seamlessly with AWS Web Application Firewall (WAF), allowing you to define and implement custom rules to block malicious traffic. This combination provides more robust protection against application-layer (Layer 7) attacks.
  • Proactive Event Response: You can configure automatic response actions, such as activating WAF rules, when specific attack patterns are detected.

7. Global Availability and Scalability​

  • AWS Shield operates across the entire AWS global network, providing DDoS protection that scales to absorb massive amounts of attack traffic without impacting application availability.

8. Visibility and Monitoring​

  • AWS CloudWatch Metrics: Both Shield Standard and Advanced provide CloudWatch metrics for monitoring network activity and identifying potential DDoS threats.
  • Real-Time Attack Metrics: Shield Advanced offers real-time attack notifications and detailed reports, helping you analyze and respond to incidents quickly.

9. Shield Advanced Pricing​

  • AWS Shield Standard is included at no extra cost with supported AWS services.
  • Shield Advanced involves a monthly subscription fee per protected resource and additional data transfer costs. It also provides DDoS cost protection, offsetting charges incurred due to DDoS attack-related resource scaling.

10. Customization and Fine-Tuning​

  • Shield Advanced allows you to create health checks and configure your DDoS protection to suit your application's specific needs. By linking Shield with health checks (e.g., Route 53), AWS can automatically mitigate the impact of an attack by shifting traffic or altering configurations.

11. Attack Mitigation and Traffic Engineering​

  • AWS Shield Advanced uses intelligent traffic filtering techniques to mitigate attacks. It can identify and mitigate malicious traffic while allowing legitimate user requests to pass through.
  • Blackhole Routing: As a last-resort measure, AWS can temporarily redirect all traffic away from a resource to protect it from a massive attack.

12. Best Practices for Effective Use​

  • Architect for Resiliency: Use CloudFront, ELB, Route 53, and Auto Scaling to help absorb and distribute traffic. Architecting your applications for elasticity can help handle unexpected spikes in traffic.
  • Enable Advanced Protection for Critical Resources: For business-critical applications, enabling Shield Advanced provides an additional layer of defense.
  • Combine with AWS WAF: Use AWS WAF to create specific rules for filtering web traffic and preventing application-layer attacks.
  • Create a Response Plan: Have a clear incident response plan, including steps to involve the DDoS Response Team (DRT) if you are subscribed to Shield Advanced.