AWS Shield
AWS Shield is a managed DDoS protection service. It comes in two tiers.
AWS Shield Standard
Section titled “AWS Shield Standard”- Included for every AWS customer at no additional cost, with nothing to enable
- Defends against the common, high-frequency network and transport layer (layer 3 and 4) attacks: SYN floods, UDP reflection, and similar volumetric traffic
- Always-on detection with automatic inline mitigation
- Applied at the AWS edge, so it is most effective in front of Amazon CloudFront, Amazon Route 53, AWS Global Accelerator and Elastic Load Balancing
AWS Shield Advanced
Section titled “AWS Shield Advanced”A paid subscription that adds:
- Protection for specified resources against larger and more sophisticated attacks, including at the application layer
- Automatic application-layer DDoS mitigation, which adds an AWS WAF rule group to the web ACL of a protected resource and generates mitigating rules during an attack
- Detailed, near-real-time attack telemetry and post-attack diagnostics
- Access to the AWS Shield Response Team (SRT). Some legacy API operations still carry the older DRT (DDoS Response Team) acronym; it is the same team.
- Cost protection: credits for the scaling charges — Elastic Load Balancing, CloudFront, Route 53, Global Accelerator, EC2 — incurred because of a documented DDoS attack
- Coverage of the standard AWS WAF charges for the resources it protects
- Organisation-wide deployment through AWS Firewall Manager
Choosing between them
Section titled “Choosing between them”Shield Standard covers the common case and costs nothing, so the question is only whether Shield Advanced is justified. It usually is when:
- An outage has a material commercial or regulatory cost
- Detailed attack visibility is needed for incident reporting
- The application is a plausible target and there is no in-house DDoS expertise to call on at 3 a.m.
- The unbounded scaling bill during an attack is itself the risk
Shield is not a substitute for the rest of the stack. Layer 7 attacks are handled by AWS WAF rules — rate-based rules, bot control, CAPTCHA and Challenge actions — and a DDoS-resilient architecture still matters: static content on Amazon S3 behind CloudFront, Auto Scaling groups that can absorb a surge, a minimal public attack surface, and CloudWatch alarms on the traffic baselines. See DDoS attacks and AWS protection strategies.