AWS Cloud Practitioner Study Notes · Part 59
AWS Shield: Standard, Advanced, and DDoS Protection
AWS Cloud Practitioner study notes explaining AWS Shield Standard and Advanced, DDoS layers, protected resources, Shield Response Team, and WAF.
An internet-facing application can become unavailable when an attacker floods it with traffic from many compromised systems. AWS Shield is AWS’s managed Distributed Denial of Service (DDoS) protection service, designed to detect and mitigate attacks against AWS resources.
This is Part 59 of the AWS Cloud Practitioner Study Notes. The exam-friendly mental model is:
AWS Shield → DDoS detection and mitigation
AWS WAF → Rules for HTTP and HTTPS web requests
GuardDuty → Threat detection from AWS activity and logs
Inspector → Vulnerability assessmentShield protects the network perimeter. It does not replace secure architecture, application controls, or a web application firewall.
What is a DDoS attack?
A Distributed Denial of Service attack uses many sources to overwhelm a target’s network, protocol handling, or application. The aim is to consume bandwidth, connection state, compute capacity, or request-processing capacity so that legitimate users cannot use the service.
Common examples include:
- Volumetric network floods
- TCP SYN floods
- UDP reflection or amplification attacks
- HTTP or HTTPS request floods
The exact protection depends on the attack layer and the AWS resource. AWS Shield provides infrastructure-level DDoS protection, while application-layer request filtering is typically designed with AWS WAF and application controls.
AWS Shield Standard
Shield Standard is automatically included for AWS customers at no additional charge. It helps protect against common, frequently occurring network and transport layer DDoS attacks.
Internet traffic
↓
Shield Standard protection
↓
CloudFront, Route 53, Global Accelerator, or load balancer
↓
Application originShield Standard is particularly valuable for applications using Amazon CloudFront, Amazon Route 53 hosted zones, and AWS Global Accelerator, because these services provide an edge or distributed entry point for internet traffic. The application’s architecture still affects its DDoS resilience; simply using Shield does not remove the need for sensible origin protection, scaling, caching, and monitoring.
Exam points:
- Automatically enabled
- No separate Shield subscription
- No additional Shield charge
- Protects common DDoS vectors, especially at Layers 3 and 4
AWS Shield Advanced
Shield Advanced is a paid subscription for applications that need expanded DDoS protection, visibility, and response capabilities. It can protect resources such as:
- Amazon CloudFront distributions
- Amazon Route 53 hosted zones
- AWS Global Accelerator standard accelerators
- Elastic Load Balancing load balancers
- Amazon EC2 instances
Shield Advanced provides additional capabilities such as advanced event visibility, DDoS detection and mitigation, application-layer protections when used with AWS WAF, and support from the Shield Response Team (SRT).
Shield Advanced
├── Advanced event visibility
├── Expanded resource protection
├── Layer 3, 4, and application-layer capabilities
├── AWS WAF integration
├── DDoS cost protection for eligible charges
└── Shield Response Team supportCost protection is not an unlimited guarantee against every bill increase. It applies to eligible AWS usage charges associated with a verified DDoS attack and requires the relevant Shield Advanced protections and configuration. Check the current service terms before treating it as a financial guarantee.
Shield Response Team
Shield Advanced customers can work with the AWS Shield Response Team during DDoS events. The SRT consists of AWS security engineers who specialise in DDoS response and can help analyse events and coordinate mitigations.
The SRT is an additional response capability, not a replacement for your own incident process. AWS documentation currently notes that SRT services require a Business or Enterprise AWS Support plan in addition to Shield Advanced.
Prepare before an incident by identifying protected resources, configuring CloudWatch alarms and notifications, documenting escalation contacts, and deciding whether AWS may assist with mitigation actions.
Shield and AWS WAF
Shield and WAF solve related but different problems:
| Service | Main focus | Example |
|---|---|---|
| AWS Shield | DDoS detection and mitigation | SYN flood or volumetric attack |
| AWS WAF | HTTP and HTTPS request inspection | SQL injection, XSS, bad bot, or rate-based rule |
For a web application, a common architecture is:
Internet
↓
AWS Shield
↓
CloudFront
↓
AWS WAF web ACL
↓
Application Load Balancer
↓
ECS, EC2, or another originAWS WAF can inspect web requests and apply rules based on IP addresses, headers, query strings, paths, request rates, managed rule groups, and other conditions. Shield does not replace WAF for SQL injection or cross-site scripting protection.
Shield Advanced can work with WAF for application-layer DDoS protection. It can analyse traffic baselines and, when configured, automatically create or manage WAF mitigations during an application-layer event. This is different from saying that every Shield deployment automatically blocks every malicious HTTP request.
Protected-resource architecture
CloudFront and an application origin
CloudFront places a globally distributed edge network in front of the origin. Shield helps protect the edge and supported resources from DDoS traffic, while caching and origin controls reduce the traffic that reaches the application:
Users and attack traffic
↓
CloudFront + Shield
↓
WAF web ACL
↓
ALB
↓
ECS or EC2This architecture is often more resilient than exposing an origin directly to the internet, but it still requires correct origin access controls. For example, ensure the origin cannot be bypassed easily if all traffic is supposed to arrive through CloudFront.
Route 53 and DNS availability
Route 53 is a supported AWS edge service that benefits from Shield protection. Shield does not replace correct DNS design, health checks, routing policies, or registrar and domain-management controls.
Load balancers and EC2
Shield Advanced can protect selected regional resources such as Elastic Load Balancing load balancers and EC2 instances. The correct resource registration and protection configuration matter; the presence of an EC2 instance alone is not a complete DDoS-resilience strategy.
Monitoring and response
Shield Advanced provides detection and mitigation information that can be monitored with Amazon CloudWatch. A response workflow might look like this:
Shield Advanced detects an event
↓
CloudWatch metric or alarm
↓
SNS notification or EventBridge workflow
↓
Security team investigates and respondsUseful operational preparation includes:
- Baseline normal traffic for important resources.
- Create CloudWatch alarms for relevant Shield Advanced metrics.
- Send notifications to the security or operations team.
- Keep contact and escalation information current.
- Test WAF rate-based and managed rules safely before an incident.
- Document origin protection and bypass-prevention controls.
- Know which events require your team, AWS Support, or the SRT.
Shield is a managed protection service, but DDoS resilience remains a shared responsibility. You design the application, choose the resources to protect, configure WAF and alarms, and operate the incident response process.
Shield versus GuardDuty and Inspector
These services are often confused because all appear in security architectures:
| Service | Detects or protects against | Main evidence or control |
|---|---|---|
| Shield | DDoS attacks against supported AWS resources | Network and application traffic signals |
| WAF | Malicious or unwanted web requests | HTTP/HTTPS request rules |
| GuardDuty | Suspicious activity and threats | AWS logs and account activity |
| Inspector | Software and workload vulnerabilities | Packages, code, and resource findings |
| Security Hub | Aggregated security findings | Findings from security services |
For example, Shield helps mitigate an internet traffic flood, GuardDuty may identify suspicious API activity or compromised credentials, and Inspector may find a vulnerable package in an EC2 workload. They are complementary, not interchangeable.
Standard versus Advanced
| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Availability | Automatically included | Paid subscription |
| Common DDoS protection | Yes | Yes, expanded |
| Network and transport layers | Common protections | Advanced protection and visibility |
| Application-layer support | Limited infrastructure protection | Available with WAF and configuration |
| Attack visibility | Basic service-level protection | Detailed event and mitigation visibility |
| Shield Response Team | No | Yes, subject to support requirements |
| DDoS cost protection | No | Available for eligible attack-related charges |
| Central multi-account management | Not the focus | Can integrate with Firewall Manager where supported |
Common exam questions
Which service provides automatic, free DDoS protection for AWS customers?
AWS Shield Standard.
Which service provides advanced DDoS visibility, cost protection, and AWS response assistance?
AWS Shield Advanced.
Which service protects against SQL injection and cross-site scripting?
AWS WAF, not Shield alone.
Which service protects against SYN floods and UDP reflection attacks?
AWS Shield.
Which service detects suspicious behaviour from AWS account activity?
Amazon GuardDuty.
Which service checks for software vulnerabilities?
Amazon Inspector.
Why use CloudFront with Shield?
CloudFront provides a distributed edge entry point and caching layer, which can reduce the impact of traffic reaching the origin while Shield provides DDoS protection.
Final memory map
Shield Standard
→ Automatic, no additional Shield charge, common DDoS protection
Shield Advanced
→ Subscription, advanced visibility, SRT, cost protection, WAF integration
WAF
→ HTTP/HTTPS request rules
GuardDuty
→ Threat detection
Inspector
→ Vulnerability assessmentThe one-sentence takeaway is: AWS Shield protects AWS applications from DDoS attacks, with Standard providing automatic baseline protection and Advanced adding expanded visibility, response, cost-protection, and WAF capabilities.