AWS Shield

What it is

AWS Shield is a managed DDoS (Distributed denial of service)An attack that floods an application or network with traffic from many sources at once, to make it unavailable to real users. AWS Shield Standard protects every AWS customer from common network-layer DDoS attacks at no extra cost.Glossary entry (distributed denial of service) protection service. It comes in two tiers:

Shield Standard: automatic protection for all AWS customers at no additional charge. It defends against the most common network and transport layer (layer 3 and 4) DDoS attacks. It is most effective for Route 53 hosted zones, CloudFront distributions, and Global Accelerator standard accelerators, which get protection against all known layer 3 and 4 attacks.
Shield Advanced: a paid subscription with expanded DDoS protection at layers 3, 4, and 7, for the resources you choose. It also covers volumetric bots and vulnerability exploitation attempts.

Choose Shield Advanced when a question asks for protection against large or sophisticated DDoS attacks, 24/7 expert help during an attack, or protection from DDoS-related cost spikes.

Shield Advanced

Protected resources must be added explicitly (or through a Firewall Manager policy):
- CloudFront distributions.
- Route 53 hosted zones.
- Global Accelerator standard accelerators.
- Elastic IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses, and EC2 instances and Network Load Balancers through their Elastic IPs.
- Application Load Balancers and Classic Load Balancers.
Shield Response Team (SRT): DDoS response specialists you can work with during events. It requires a Business Support or Enterprise Support plan.
DDoS cost protection: protection against scaling charges caused by DDoS attacks, subject to the subscription commitment.
AWS WAF included: the subscription covers standard AWS WAF fees for protected resources, up to a large monthly request volume.
Commitment: a 1-year subscription with a monthly fee, plus usage fees for data transfer out from protected services.

Designing for DDoS resilience

Put CloudFront, Route 53, and Global Accelerator in front of applications, so attacks are absorbed at the AWS edge, where Shield is most effective.
Use Auto Scaling and load balancers to absorb surges, and AWS WAF rate-based rules for layer 7 floods.
Keep origins private, for example with CloudFront VPC origins or Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry that only allow the edge.

AWS Shield network security director (preview) is a newer capability that discovers your compute, network, and network security resources, analyzes their configuration against best practices and threat intelligence, and rates findings with remediation steps.

Shield or another option?

If the requirement is	Choose
Basic DDoS protection for everyone	Shield Standard (automatic)
Large DDoS attacks, expert response, and cost protection	Shield Advanced
Block SQL injectionAn attack that slips SQL code into form fields or parameters so that an application runs it against its database, for example to read or delete data. Parameterized queries prevent it, and AWS WAF can block common patterns.Glossary entry, XSS (Cross-site scripting)An attack that injects malicious script into a web page so that it runs in other users' browsers, where it can steal their session or data. AWS WAF has rules that match common XSS patterns in requests.Glossary entry, or bad IPs	AWS WAF
Apply Shield Advanced to all accounts and new resources	AWS Firewall Manager
Absorb attacks at the edge	CloudFront, Route 53, and Global Accelerator

Reverse mindmap: when the question points here

Is it AWS Shield?

Yes, when the question says
- DDoS protection leads to Shield
- Free protection for every account leads to Shield Standard
- Layer 7 DDoS with expert help leads to Shield Advanced with the SRT
- Avoid bills from scaling during an attack leads to Shield Advanced cost protection
- Protect an Elastic IP or NLB from DDoS leads to Shield Advanced
Build it in
- Absorb attacks at the edge leads to CloudFront, Route 53, Global Accelerator
- Rate-limit HTTP floods leads to WAF rate-based rules
- Apply protections across accounts leads to Firewall Manager
No, when the question says
- SQL injection leads to WAF

Key takeaways

Shield Standard protects every AWS customer from common layer 3 and 4 DDoS attacks at no charge, especially on CloudFront, Route 53, and Global Accelerator.
Shield Advanced adds layer 7 protection for chosen resources, the Shield Response Team (with Business or Enterprise Support), DDoS cost protection, and included WAF fees.
Shield Advanced requires a 1-year commitment.
Design for resilience with edge services, Auto Scaling, load balancers, and WAF.