Skip to content

AWS Shield

Service Overview and Purpose

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, giving you two tiers of protection against DDoS attacks.

Core Purpose: - Protect AWS resources from DDoS attacks - Minimize application downtime and latency - Provide real-time attack visibility and reporting - Offer financial protection against DDoS-related costs - Enable proactive threat intelligence and mitigation

Key Features and Capabilities

AWS Shield Standard

  1. Automatic Protection
  2. Always-on DDoS protection for all AWS customers
  3. Protection against common layer 3 and layer 4 attacks
  4. No additional cost or configuration required

  5. Automatic scaling to handle attack traffic

  6. Protected Resources

  7. Amazon CloudFront distributions
  8. Amazon Route 53 hosted zones
  9. AWS Global Accelerator accelerators
  10. Elastic Load Balancing (ELB)

  11. Amazon EC2 Elastic IP addresses

  12. Attack Mitigation

  13. Network-level DDoS protection
  14. Automatic detection and mitigation
  15. Traffic filtering and rate limiting
  16. Absorption of most common attacks

AWS Shield Advanced

  1. Enhanced Protection
  2. Advanced DDoS protection and mitigation
  3. 24/7 access to DDoS Response Team (DRT)
  4. Real-time attack notifications and reporting

  5. Advanced attack diagnostics and analysis

  6. Financial Protection

  7. DDoS cost protection for scaling charges
  8. Protection against usage spikes during attacks
  9. Financial assistance for DDoS-related costs

  10. Cost optimization recommendations

  11. Additional Features

  12. Advanced reporting and analytics
  13. Custom mitigation policies
  14. Integration with AWS WAF
  15. Proactive engagement during attacks

Use Cases and Scenarios

Primary Use Cases

  1. Web Application Protection: Shield web applications from DDoS attacks
  2. API Security: Protect APIs from volumetric attacks
  3. E-commerce Platforms: Ensure availability during traffic spikes
  4. Gaming Applications: Protect against targeted gaming attacks
  5. Financial Services: Maintain service availability for critical applications
  6. Media Streaming: Protect content delivery from disruption
  7. Enterprise Applications: Secure business-critical applications
  8. Government Services: Protect public-facing government applications
  9. Healthcare Systems: Ensure availability of critical healthcare services
  10. Educational Platforms: Protect online learning platforms

Scenario Examples

  • High-Profile Website: Protection against politically motivated attacks
  • Black Friday Sale: E-commerce protection during peak traffic events
  • Live Streaming Event: Media protection during major broadcasts
  • Online Banking: Financial service protection against targeted attacks
  • Gaming Tournament: Protection during competitive gaming events

Pricing Models and Cost Optimization

AWS Shield Standard

  • Cost: Free for all AWS customers
  • No additional charges for basic DDoS protection
  • Included protection for CloudFront, Route 53, and other services

AWS Shield Advanced

  1. Monthly Subscription: $3,000 per month per organization
  2. Data Transfer Charges: Standard AWS data transfer rates apply
  3. Additional Protection: No extra charges for protected resources

Cost Protection Benefits (Shield Advanced)

  • DDoS Cost Protection: Protection against scaling charges during attacks
  • Usage Credits: Financial assistance for attack-related usage spikes
  • Consultation Services: Included DRT consultation at no additional cost

Cost Optimization Strategies

  1. Architecture Design: Use Shield-protected services in your architecture
  2. Traffic Management: Implement proper traffic routing and filtering
  3. Monitoring: Regular review of traffic patterns and costs
  4. Proactive Mitigation: Work with DRT for preventive measures
  5. Resource Optimization: Optimize resource usage during normal operations

Configuration Details and Best Practices

Shield Standard Configuration

# Shield Standard is automatically enabled
# No configuration required - protection is always-on
# Verify protection status for resources
aws shield describe-protection --resource-arn arn:aws:cloudfront::123456789012:distribution/E1234567890123

Shield Advanced Setup

{
  "ProtectionName": "MyCloudFrontProtection",
  "ResourceArn": "arn:aws:cloudfront::123456789012:distribution/E1234567890123",
  "Tags": [
    {
      "Key": "Environment",
      "Value": "Production"
    }
  ]
}

Best Practices

  1. Architecture Design
  2. Use multiple Availability Zones
  3. Implement auto-scaling groups
  4. Configure CloudFront for global distribution
  5. Use Elastic Load Balancers for traffic distribution

  6. Design for fault tolerance and redundancy

  7. Shield Advanced Configuration

  8. Enable protection for all critical resources
  9. Configure emergency contact information
  10. Set up CloudWatch alarms for attack detection
  11. Integrate with AWS WAF for application-layer protection

  12. Regular testing and validation of protection

  13. Monitoring and Response

  14. Enable detailed monitoring and logging
  15. Set up automated response procedures
  16. Regular review of attack reports and analytics
  17. Proactive communication with DRT

  18. Document incident response procedures

  19. Cost Management

  20. Monitor usage during attacks
  21. Review cost protection benefits
  22. Optimize resource allocation
  23. Regular cost analysis and optimization

Integration with Other AWS Services

Core Integrations

  1. CloudFront: Global content delivery with DDoS protection
  2. Route 53: DNS service with built-in DDoS protection
  3. Elastic Load Balancing: Load balancer protection
  4. AWS WAF: Application-layer security integration
  5. CloudWatch: Monitoring and alerting for attacks
  6. CloudTrail: API call logging and audit trails
  7. AWS Config: Configuration compliance monitoring
  8. Systems Manager: Incident response automation
  9. SNS: Attack notification and alerting
  10. Global Accelerator: Network performance and protection

Advanced Integrations

  1. Security Hub: Centralized security findings management
  2. GuardDuty: Threat detection and intelligence
  3. Inspector: Application vulnerability assessment
  4. Trusted Advisor: Cost and performance optimization
  5. Organizations: Multi-account protection management
  6. Lambda: Automated response functions
  7. API Gateway: API protection and rate limiting

Security Considerations

Attack Protection

  • Layer ¾ Protection: Network and transport layer DDoS protection
  • Application Layer: Integration with WAF for layer 7 protection
  • Volumetric Attacks: Protection against high-volume traffic attacks
  • Protocol Attacks: Protection against TCP SYN floods and other protocol attacks
  • Resource Exhaustion: Protection against attacks targeting specific resources

Threat Intelligence

  • Real-time Detection: Continuous monitoring for attack patterns
  • Attack Attribution: Understanding attack sources and methods
  • Threat Landscape: Insights into current DDoS trends
  • Predictive Analysis: Proactive threat identification
  • Global Intelligence: Leverage AWS global threat intelligence

Compliance and Governance

  • Audit Logging: Comprehensive logging of protection events
  • Compliance Reporting: Meeting regulatory requirements
  • Incident Documentation: Detailed attack reports and analysis
  • Service Level Agreements: Protection SLA guarantees

Monitoring and Troubleshooting

CloudWatch Metrics (Shield Advanced)

  • DDoSDetected: DDoS attack detection events
  • DDoSAttackBitsPerSecond: Attack traffic volume
  • DDoSAttackPacketsPerSecond: Attack packet rate
  • DDoSAttackRequestsPerSecond: Attack request rate

Attack Reporting and Analytics

  1. Global Threat Environment Dashboard
  2. Real-time global DDoS attack visibility
  3. Attack trends and patterns
  4. Geographic attack distribution

  5. Attack vector analysis

  6. Attack Diagnostics

  7. Detailed attack timeline and characteristics
  8. Traffic analysis and filtering effectiveness
  9. Mitigation effectiveness reporting
  10. Performance impact assessment

Common Issues and Solutions

  1. False Positive Alerts
  2. Review traffic patterns and thresholds
  3. Adjust monitoring sensitivity
  4. Validate legitimate traffic sources

  5. Fine-tune detection parameters

  6. Performance Impact

  7. Monitor application performance during attacks
  8. Optimize resource allocation
  9. Review traffic routing and distribution

  10. Implement caching and optimization strategies

  11. Cost Concerns

  12. Monitor usage and billing during attacks
  13. Leverage cost protection benefits
  14. Review resource scaling policies

  15. Optimize infrastructure costs

  16. Attack Persistence

  17. Escalate to DRT for advanced support
  18. Implement additional mitigation strategies
  19. Review and update protection policies
  20. Consider architectural improvements

Monitoring Tools

  1. Shield Dashboard: Real-time protection status and metrics
  2. CloudWatch Dashboards: Custom monitoring and alerting
  3. AWS Health Dashboard: Service health and incident updates
  4. Third-party Tools: SIEM integration and advanced analytics

Exam-Specific Tips and Common Scenarios

Solutions Architect Associate (SAA-C03)

  • DDoS Protection Strategy: Implementing Shield with other AWS services
  • Cost-Effective Protection: Understanding Shield Standard vs Advanced
  • Architecture Design: DDoS-resilient application architecture
  • Service Integration: Combining Shield with CloudFront and WAF

Solutions Architect Professional (SAP-C02)

  • Enterprise DDoS Strategy: Multi-account and multi-region protection
  • Advanced Mitigation: Custom protection policies and response procedures
  • Business Continuity: DDoS protection in disaster recovery planning
  • Compliance: Meeting regulatory DDoS protection requirements

Security Specialty (SCS-C02)

  • Advanced Threat Protection: Shield Advanced features and capabilities
  • Incident Response: DDoS attack response and mitigation procedures
  • Threat Intelligence: Leveraging Shield threat intelligence
  • Integration Strategy: Comprehensive security architecture with Shield

SysOps Administrator (SOA-C02)

  • Operational Procedures: Managing DDoS protection and response
  • Monitoring and Alerting: Setting up effective DDoS monitoring
  • Cost Management: Optimizing Shield-related costs
  • Incident Management: Operational response to DDoS attacks

Common Exam Scenarios

  1. Scenario: Web application experiencing volumetric DDoS attack Solution: Enable Shield Advanced with WAF integration and DRT support

  2. Scenario: Need cost-effective DDoS protection for static website Solution: Use CloudFront with Shield Standard protection

  3. Scenario: Gaming application targeted by sophisticated DDoS attacks Solution: Implement Shield Advanced with custom mitigation policies

  4. Scenario: Financial application requires guaranteed DDoS protection Solution: Shield Advanced with 24/7 DRT support and cost protection

Hands-on Examples and CLI Commands

Shield Protection Management

# Subscribe to Shield Advanced
aws shield subscribe-to-proactive-engagement \
  --emergency-contact-list '[
    {
      "EmailAddress": "security@example.com",
      "ContactNotes": "Primary security contact"
    }
  ]'

# Create protection for CloudFront distribution
aws shield create-protection \
  --name "CloudFrontProtection" \
  --resource-arn "arn:aws:cloudfront::123456789012:distribution/E1234567890123"

# Create protection for Elastic Load Balancer
aws shield create-protection \
  --name "ALBProtection" \
  --resource-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890123456"

# List all protections
aws shield list-protections

# Describe specific protection
aws shield describe-protection \
  --resource-arn "arn:aws:cloudfront::123456789012:distribution/E1234567890123"

# Delete protection
aws shield delete-protection \
  --resource-arn "arn:aws:cloudfront::123456789012:distribution/E1234567890123"

Attack Information and Reporting

# List DDoS attacks
aws shield list-attacks \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-31T23:59:59Z

# Describe specific attack
aws shield describe-attack \
  --attack-id "12345678-1234-1234-1234-123456789012"

# Get attack statistics
aws shield describe-attack-statistics

# Get DDoS timeline
aws shield get-subscription-state

Emergency Contact Management

# Update emergency contacts
aws shield update-emergency-contact-settings \
  --emergency-contact-list '[
    {
      "EmailAddress": "primary@example.com",
      "PhoneNumber": "+1-555-0123",
      "ContactNotes": "Primary security contact - available 24/7"
    },
    {
      "EmailAddress": "secondary@example.com",
      "PhoneNumber": "+1-555-0124",
      "ContactNotes": "Secondary security contact"
    }
  ]'

# Describe emergency contacts
aws shield describe-emergency-contact-settings

Proactive Engagement

# Enable proactive engagement
aws shield enable-proactive-engagement

# Disable proactive engagement
aws shield disable-proactive-engagement

# Check proactive engagement status
aws shield describe-subscription

Monitoring and Metrics

# Create CloudWatch alarm for DDoS detection
aws cloudwatch put-metric-alarm \
  --alarm-name "DDoSAttackDetected" \
  --alarm-description "Alert when DDoS attack is detected" \
  --metric-name "DDoSDetected" \
  --namespace "AWS/DDoSProtection" \
  --statistic "Maximum" \
  --period 300 \
  --threshold 1 \
  --comparison-operator "GreaterThanOrEqualToThreshold" \
  --evaluation-periods 1 \
  --alarm-actions "arn:aws:sns:us-east-1:123456789012:ddos-alerts"

# Get DDoS protection metrics
aws cloudwatch get-metric-statistics \
  --namespace "AWS/DDoSProtection" \
  --metric-name "DDoSAttackBitsPerSecond" \
  --dimensions Name=ResourceArn,Value="arn:aws:cloudfront::123456789012:distribution/E1234567890123" \
  --statistics Maximum \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-01T01:00:00Z \
  --period 300

# List available metrics
aws cloudwatch list-metrics --namespace "AWS/DDoSProtection"

Integration with WAF

# Associate WAF Web ACL with protected resource
aws wafv2 associate-web-acl \
  --web-acl-arn "arn:aws:wafv2:us-east-1:123456789012:global/webacl/MyWebACL/12345678-1234-1234-1234-123456789012" \
  --resource-arn "arn:aws:cloudfront::123456789012:distribution/E1234567890123"

# Create rate-based rule for DDoS protection
aws wafv2 update-web-acl \
  --scope CLOUDFRONT \
  --id "12345678-1234-1234-1234-123456789012" \
  --name "MyWebACL" \
  --default-action Allow={} \
  --rules '[
    {
      "Name": "DDoSRateLimit",
      "Priority": 1,
      "Statement": {
        "RateBasedStatement": {
          "Limit": 2000,
          "AggregateKeyType": "IP"
        }
      },
      "Action": {"Block": {}},
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "DDoSRateLimit"
      }
    }
  ]' \
  --lock-token "12345678-1234-1234-1234-123456789012"

Cost Protection and Analysis

# Get subscription details including cost protection
aws shield describe-subscription

# List protected resources and their protection status
aws shield list-protections --output table

# Check for any DDoS-related charges
aws ce get-cost-and-usage \
  --time-period Start=2023-01-01,End=2023-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

Incident Response Automation

# Lambda function for automated DDoS response
import boto3
import json

def lambda_handler(event, context):
    """
    Automated response to DDoS attack detection
    """
    shield = boto3.client('shield')
    sns = boto3.client('sns')

    # Parse CloudWatch alarm
    message = json.loads(event['Records'][0]['Sns']['Message'])

    if message['AlarmName'] == 'DDoSAttackDetected':
        # Get attack details
        attacks = shield.list_attacks(
            StartTime=datetime.utcnow() - timedelta(hours=1),
            EndTime=datetime.utcnow()
        )

        # Send notification to security team
        sns.publish(
            TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',
            Subject='DDoS Attack Detected',
            Message=f'DDoS attack detected. Latest attacks: {attacks["AttackSummaries"]}'
        )

        # Trigger additional security measures
        # e.g., increase WAF rate limits, scale infrastructure, etc.

    return {
        'statusCode': 200,
        'body': json.dumps('DDoS response executed successfully')
    }

This comprehensive AWS Shield documentation provides detailed coverage of DDoS protection strategies and implementation details essential for AWS certification preparation and real-world security operations.